UpHeron
All vulnerabilities

Servers and applications

CVE-2025-23048

In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a…

Severity
Critical 9.1
Published
10 Jul 2025
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Fixed in
2.4.64
Sources
NVD

Affected software

SoftwareAffected versions
Apache HTTP ServerServers and applications · cpe:a:apache:http_server
  • From 2.4.35 before 2.4.64

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-23048
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-23048