CVE-2025-54090
Fixed in a distro release EPSS <1%CVSS 6.3
A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue.
Products: Apache Software Foundation Apache HTTP Server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.19 | apache2 | 2.4.65-r0 |
| Alpine 3.20 | apache2 | 2.4.65-r0 |
| Alpine 3.21 | apache2 | 2.4.65-r0 |
| Alpine 3.22 | apache2 | 2.4.65-r0 |
| Alpine 3.23 | apache2 | 2.4.65-r0 |
| Alpine 3.24 | apache2 | 2.4.65-r0 |
| Debian 13 | apache2 | 2.4.65-1 |
| Debian 14 | apache2 | 2.4.65-1 |
| openSUSE Tumbleweed | apache2 | 2.4.65-1.1 |