Every CVE Search/ Get API key

CVE-2025-54090

Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64

6.3 MediumFix available

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true".

Users are recommended to upgrade to version 2.4.65, which fixes the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.88%Up 0.8 points since Jul 24, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.3

Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true".

Users are recommended to upgrade to version 2.4.65, which fixes the issue.

Record
CVE-2025-54090
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-253
Updated
2026-11-02
EUVDEUVD-2025-22448 6.3

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true".

Users are recommended to upgrade to version 2.4.65, which fixes the issue.

Record
EUVD-2025-22448
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-cjqj-vhhm-xq5x 6.3

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as ...

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true".

Users are recommended to upgrade to version 2.4.65, which fixes the issue.

Record
GHSA-cjqj-vhhm-xq5x
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-253
Updated
2026-11-02
NVD 6.3

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true".

Users are recommended to upgrade to version 2.4.65, which fixes the issue.

Record
CVE-2025-54090
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-253
Updated
2026-11-02
OSVALPINE-CVE-2025-54090 6.3

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true".

Users are recommended to upgrade to version 2.4.65, which fixes the issue.

Record
ALPINE-CVE-2025-54090
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVBELL-CVE-2025-54090 6.3
Record
BELL-CVE-2025-54090
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
Show 7 moreShow less
OSV 6.3

Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true".

Users are recommended to upgrade to version 2.4.65, which fixes the issue.

Record
CVE-2025-54090
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-253
Updated
2026-11-02
OSVDEBIAN-CVE-2025-54090 6.3

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue.

Record
DEBIAN-CVE-2025-54090
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVAZL-65654 No score

CVE-2025-54090 affecting package httpd for versions less than 2.4.65-1

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true".

Users are recommended to upgrade to version 2.4.65, which fixes the issue.

Record
AZL-65654
Updated
2026-11-02
OSVBIT-apache-2025-54090 No score

Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true".

Users are recommended to upgrade to version 2.4.65, which fixes the issue.

Record
BIT-apache-2025-54090
Updated
2026-11-02
OSVCLSA-2026-1777946314 No score

httpd: Fix of 4 CVEs

  • CVE-2024-42516: fix HTTP response splitting in core via Content-Type response header (header_filter rewrite)
  • CVE-2024-43204: prevent SSRF via mod_headers RequestHeader set/edit Content-Type modifying response headers
  • CVE-2024-43394: expand UNC path checking with new ap_stat_check helper (Linux: defense-in-depth no-op); fold in upstream fix for CVE-2025-54090 (RewriteCond expr always evaluating true regression)
Record
CLSA-2026-1777946314
Updated
2026-11-02
OSVMGASA-2025-0301 No score

Updated apache packages fix security vulnerabilities

HTTP response splitting. (CVE-2024-42516) SSRF with mod_headers setting Content-Type header. (CVE-2024-43204) mod_ssl error log variable escaping. (CVE-2024-47252) mod_proxy_http2 denial of service. (CVE-2025-49630) mod_ssl access control bypass with session resumption. (CVE-2025-23048) mod_ssl TLS upgrade attack. (CVE-2025-49812) HTTP/2 DoS by Memory Increase. (CVE-2025-53020) 'RewriteCond expr' always evaluates to true in 2.4.64. (CVE-2025-54090) You will find the update delay sometimes causes a failure; just restart the service after the update.

Record
MGASA-2025-0301
Updated
2026-11-02
OSVopenSUSE-SU-2025:15384-1 No score

apache2-2.4.65-1.1 on GA media

These are all security issues fixed in the apache2-2.4.65-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15384-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache2
Alpine:v3.19
 before 2.4.65-r0
2.4.65-r0
apache2
Alpine:v3.20
 before 2.4.65-r0
2.4.65-r0
apache2
Alpine:v3.21
 before 2.4.65-r0
2.4.65-r0
apache2
Alpine:v3.22
 before 2.4.65-r0
2.4.65-r0
apache2
Alpine:v3.23
 before 2.4.65-r0
2.4.65-r0
apache2
Alpine:v3.24
 before 2.4.65-r0
2.4.65-r0
httpd
Azure Linux:3
 before 2.4.65-1
2.4.65-1
apache2
Alpaquita:23
 2.4.54-r2 up to 2.4.65-r0
2.4.65-r0
apache2
Alpaquita:25
 2.4.63-r0 up to 2.4.65-r0
2.4.65-r0
apache2
Alpaquita:stream
 2.4.56-r0 up to 2.4.65-r0
2.4.65-r0
Show 16 moreShow less
Affected packages
PackageAffectedFixed
apache
Bitnami
 2.4.64 up to 2.4.65
2.4.65
httpd
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 2.4.62-4.el9_6.4.tuxcare.els3
2.4.62-4.el9_6.4.tuxcare.els3
httpd-core
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 2.4.62-4.el9_6.4.tuxcare.els3
2.4.62-4.el9_6.4.tuxcare.els3
httpd-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 2.4.62-4.el9_6.4.tuxcare.els3
2.4.62-4.el9_6.4.tuxcare.els3
httpd-filesystem
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 2.4.62-4.el9_6.4.tuxcare.els3
2.4.62-4.el9_6.4.tuxcare.els3
httpd-manual
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 2.4.62-4.el9_6.4.tuxcare.els3
2.4.62-4.el9_6.4.tuxcare.els3
httpd-tools
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 2.4.62-4.el9_6.4.tuxcare.els3
2.4.62-4.el9_6.4.tuxcare.els3
mod_ldap
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 2.4.62-4.el9_6.4.tuxcare.els3
2.4.62-4.el9_6.4.tuxcare.els3
mod_lua
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 2.4.62-4.el9_6.4.tuxcare.els3
2.4.62-4.el9_6.4.tuxcare.els3
mod_proxy_html
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 1:2.4.62-4.el9_6.4.tuxcare.els3
1:2.4.62-4.el9_6.4.tuxcare.els3
mod_session
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 2.4.62-4.el9_6.4.tuxcare.els3
2.4.62-4.el9_6.4.tuxcare.els3
mod_ssl
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 1:2.4.62-4.el9_6.4.tuxcare.els3
1:2.4.62-4.el9_6.4.tuxcare.els3
apache2
Debian:13
 before 2.4.65-1
2.4.65-1
apache2
Debian:14
 before 2.4.65-1
2.4.65-1
apache
Mageia:9
From an advisory covering 8 CVEs
 before 2.4.65-1.mga9
2.4.65-1.mga9
apache2
openSUSE:Tumbleweed
 before 2.4.65-1.1
2.4.65-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-54090 is a medium vulnerability (CVSS 6.3) in Apache Http Server, published July 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in apache2 2.4.65-r0.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open