CVE-2025-49812

Publication date 10 July 2025

Last updated 16 July 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

7.4 · High

Score breakdown

In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.

Status

Package Ubuntu Release Status
apache2 25.04 plucky
Fixed 2.4.63-1ubuntu1.1
24.04 LTS noble
Fixed 2.4.58-1ubuntu8.7
22.04 LTS jammy
Fixed 2.4.52-1ubuntu4.15
20.04 LTS focal
Needs evaluation
18.04 LTS bionic
Needs evaluation
16.04 LTS xenial
Needs evaluation
14.04 LTS trusty
Needs evaluation

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
apache2

Severity score breakdown

Parameter Value
Base score 7.4 · High
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact None
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N