Most recent entries from all

ALSA-2025:14625 — Moderate: mod_http2 security update

Affected: AlmaLinux:10: mod_http2

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

* httpd: mod_proxy_http2: untrusted input from a client causes an assertion to fail in the Apache mod_proxy_http2 module (CVE-2025-49630)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-08695

BELL-CVE-2025-49630

Affected: Alpaquita:23: apache2, Alpaquita:25: apache2, Alpaquita:stream: apache2

BIT-apache-2025-49630 — Apache HTTP Server: mod_proxy_http2 denial of service

Affected: Bitnami: apache

In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2.

Configurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to "on".

certfr-2025-avi-0586 — De multiples vulnérabilités ont été découvertes dans Apache HTTP Server. Certaines d'entre elles permettent à un attaqu…

certfr-2025-avi-0586

cnvd-2025-16603

EUVD-2026-259970

fkie_cve-2025-49630

In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2.

Configurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to "on".

GHSA-72h2-3r97-f454

In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2.

Configurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to "on".

jvndb-2026-003910

Multiple vulnerabilities have been found in Cosminexus HTTP Server. CVE-2025-49630, CVE-2025-53020 These vulnerabilities does not apply if HTTP/2 protocol is disabled.

msrc_CVE-2025-49630 — Apache HTTP Server: mod_proxy_http2 denial of service

msrc_CVE-2025-49630

OESA-2025-2076 — mod_http2 security update

Affected: openEuler:22.03-LTS-SP3: mod_http2, openEuler:22.03-LTS-SP4: mod_http2, openEuler:24.03-LTS: mod_http2, openEuler:24.03-LTS-SP1: mod_http2, openEuler:24.03-LTS-SP2: mod_http2, openEuler:20.03-LTS-SP4: mod_http2

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es):

A vulnerability classified as problematic has been found in Apache HTTP Server up to 2.4.63 (Web Server).CWE is classifying the issue as CWE-617. The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.This is going to have an impact on availability.Upgrading to version 2.4.64 eliminates this vulnerability.The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-21017).(CVE-2025-49630)

openSUSE-SU-2025:15360-1 — apache2-2.4.64-1.1 on GA media

apache2-2.4.64-1.1 on GA media

RHSA-2025:13680 — Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP1 security update

httpd: insufficient escaping of user-supplied data in mod_ssl httpd: mod_ssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption modsecurity: ModSecurity Has Possible DoS Vulnerability httpd: mod_proxy_http2: untrusted input from a client causes an assertion to fail in the Apache mod_proxy_http2 module httpd: HTTP Session Hijack via a TLS upgrade

SUSE-SU-2025:02565-1 — Security update for apache2

Security update for apache2

UBUNTU-CVE-2025-49630

Affected: Ubuntu:Pro:18.04:LTS: apache2, Ubuntu:Pro:20.04:LTS: apache2, Ubuntu:22.04:LTS: apache2, Ubuntu:24.04:LTS: apache2

In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2. Configurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to "on".

WID-SEC-W-2025-1529 — Apache HTTP Server: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um Dateien zu manipulieren.