UpHeron
All vulnerabilities

Servers and applications

CVE-2025-49630

In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2. Configurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to "on".

Severity
High 7.5
Published
10 Jul 2025
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Fixed in
2.4.64
Sources
NVD

Affected software

SoftwareAffected versions
Apache HTTP ServerServers and applications · cpe:a:apache:http_server
  • From 2.4.26 before 2.4.64

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-49630
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-49630