CVE-2025-54090CWE-253

Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64

Medium · published July 23, 2025

CVSS v3.1
6.3
EPSS
1%
Percentile
56.8
In the wild
Unconfirmed
What it is

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true".

Users are recommended to upgrade to version 2.4.65, which fixes the issue.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00819 · 56.8th percentile
Weakness
CWE-253 · Incorrect Check of Function Return Value
Published
2025-07-23T13:19Z
EPSS history
Timeline
  • 23 JUL 13:19Z
    Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64
    cvelistv5