CVE-2025-49812CWE-287

Apache HTTP Server: mod_ssl TLS upgrade attack

High · published July 10, 2025

CVSS v3.1
7.4
EPSS
1%
Percentile
48.7
In the wild
Unconfirmed
What it is

In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.

Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00614 · 48.7th percentile
Weakness
CWE-287 · Improper Authentication
Published
2025-07-10T16:58Z
EPSS history
Timeline
  • 10 JUL 16:58Z
    Apache HTTP Server: mod_ssl TLS upgrade attack
    cvelistv5