CVE-2025-53020CWE-401

Apache HTTP Server: HTTP/2 DoS by Memory Increase

High · published July 10, 2025

CVSS v3.1
7.5
EPSS
5%
Percentile
92.2
In the wild
Unconfirmed
What it is

Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server.

This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63.

Users are recommended to upgrade to version 2.4.64, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.04963 · 92.2th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2025-07-10T16:59Z
EPSS history
Timeline
  • 10 JUL 16:59Z
    Apache HTTP Server: HTTP/2 DoS by Memory Increase
    cvelistv5