CVE-2025-58098

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.

This issue affects Apache HTTP Server before 2.4.66.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

An integer overflow vulnerability was found in Apache HTTP Server versions 2.4.30 to 2.4.66. In case of failed ACME certificate renewal, after a number of failures (~30 days in default configurations), the backoff timer becomes 0. Certificate renewal attempts are then repeated without delays until successful. This issue affects confidentiality, integrity, and availability.(CVE-2025-55753)

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.

This issue affects Apache HTTP Server before 2.4.66.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-58098)

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.

This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.

Users are recommended to upgrade to version 2.4.66 which fixes the issue.(CVE-2025-65082)

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.

This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-66200)

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

An integer overflow vulnerability was found in Apache HTTP Server versions 2.4.30 to 2.4.66. In case of failed ACME certificate renewal, after a number of failures (~30 days in default configurations), the backoff timer becomes 0. Certificate renewal attempts are then repeated without delays until successful. This issue affects confidentiality, integrity, and availability.(CVE-2025-55753)

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.

This issue affects Apache HTTP Server before 2.4.66.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-58098)

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.

This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.

Users are recommended to upgrade to version 2.4.66 which fixes the issue.(CVE-2025-65082)

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.

This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-66200)

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

An integer overflow vulnerability was found in Apache HTTP Server versions 2.4.30 to 2.4.66. In case of failed ACME certificate renewal, after a number of failures (~30 days in default configurations), the backoff timer becomes 0. Certificate renewal attempts are then repeated without delays until successful. This issue affects confidentiality, integrity, and availability.(CVE-2025-55753)

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.

This issue affects Apache HTTP Server before 2.4.66.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-58098)

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.

This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.

Users are recommended to upgrade to version 2.4.66 which fixes the issue.(CVE-2025-65082)

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.

This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-66200)

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.

This issue affects Apache HTTP Server before 2.4.66.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-58098)

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.

This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.

Users are recommended to upgrade to version 2.4.66 which fixes the issue.(CVE-2025-65082)

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.

This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-66200)

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

An integer overflow vulnerability was found in Apache HTTP Server versions 2.4.30 to 2.4.66. In case of failed ACME certificate renewal, after a number of failures (~30 days in default configurations), the backoff timer becomes 0. Certificate renewal attempts are then repeated without delays until successful. This issue affects confidentiality, integrity, and availability.(CVE-2025-55753)

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.

This issue affects Apache HTTP Server before 2.4.66.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-58098)

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.

This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.

Users are recommended to upgrade to version 2.4.66 which fixes the issue.(CVE-2025-65082)

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.

This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-66200)

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)

• mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)

• httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)

• httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)

• httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)

• httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)

• httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)

• httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)
• mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)
• httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)
• httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)
• httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)
• httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)
• httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)
• httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.

This issue affects Apache HTTP Server before 2.4.66.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.

This issue affects Apache HTTP Server before 2.4.66.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.

This issue affects Apache HTTP Server before 2.4.66.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.

• CVE-2025-58098: prevent command injection in mod_cgid via shell-escaped SSI query strings

• CVE-2025-58098: prevent SSI args from being passed to CGI scripts

• CVE-2025-58098: don't pass querry string args as command line arguments to SSI-invoked CGI scripts

• CVE-2025-58098: fix mod_cgid to not pass arguments for SSI requests

• CVE-2025-58098: don't pass querry string args as command line arguments to SSI-invoked CGI scripts

• CVE-2025-58098: fix passes the shell-escaped query string to #exec cmd="..." directives

• CVE-2025-58098: fix passes the shell-escaped query string to #exec cmd="..." directives

• CVE-2025-58098: fix passes the shell-escaped query string to #exec cmd="..." directives

• CVE-2025-58098: mod_cgid with SSI #exec cmd passed the shell-escaped query string as extra arguments to the executed shell command; do not pass r->args for SSI requests

• SECURITY UPDATE: potential SSRF via unsafe mod_rewrite substitution
  • debian/patches/CVE-2024-39573.patch: re-add the stripped per-directory prefix (or an implicit '/') to the substituted URI before it can be mistaken for a scheme:// proxy URL, in modules/mappers/mod_rewrite.c.
  • CVE-2024-39573
• SECURITY UPDATE: SSI #exec cmd query string passed to shell via mod_cgid
  • debian/patches/CVE-2025-58098.patch: do not pass r->args to create_argv() for SSI requests in modules/generators/mod_cgid.c.
  • CVE-2025-58098

• SECURITY UPDATE: potential SSRF via unsafe mod_rewrite substitution
  • debian/patches/CVE-2024-39573.patch: re-add the stripped per-directory prefix (or an implicit '/') to the substituted URI before it can be mistaken for a scheme:// proxy URL, in modules/mappers/mod_rewrite.c.
  • CVE-2024-39573
• SECURITY UPDATE: SSI #exec cmd query string passed to shell via mod_cgid
  • debian/patches/CVE-2025-58098.patch: do not pass r->args to create_argv() for SSI requests in modules/generators/mod_cgid.c.
  • CVE-2025-58098

• SECURITY UPDATE: query string passed to SSI "#exec cmd" via mod_cgid
  • debian/patches/CVE-2025-58098.patch: in cgid_server() in modules/generators/mod_cgid.c, do not pass the request query string (r->args) to create_argv() for Server Side Includes requests by passing NULL when cgid_req.req_type == SSI_REQ, and add a NULL guard to create_argv() so a shell-escaped query string can no longer be split into extra arguments of an SSI "#exec cmd" command. Backported from httpd commit ecc1b8f3817e3dcab9c1f24f905752d3c0a279af (SVN r1930161).
  • CVE-2025-58098
• SECURITY UPDATE: log injection via unescaped mod_ssl log variables
  • debian/patches/CVE-2024-47252.patch: in ssl_var_log_handler_c() and ssl_var_log_handler_x() in modules/ssl/ssl_engine_vars.c, escape the SSL/TLS variables returned by these mod_ssl log handlers with ap_escape_logitem() so client-supplied values such as SSL_TLS_SNI logged via "%{varname}c"/"%{varname}x" can no longer insert escape characters into log files. Backported from httpd commit c01e60707048be14a510f0a92128a5227923215c (SVN r1927042).
  • CVE-2024-47252

• SECURITY UPDATE: potential SSRF in mod_rewrite via RewriteRule substitutions that produce a scheme-like target
  • debian/patches/CVE-2024-39573.patch: add the previously stripped per-directory prefix, or an implicit '/' root prefix, to the substituted URI before the query args are split in apply_rewrite_rule() in modules/mappers/mod_rewrite.c; otherwise a rule such as "RewriteRule ^/some/path(.*) $1" turns "/some/pathscheme:..." into the fully qualified URL "scheme:...", which mod_proxy then handles. Upstream fix 93aec0e3ca451bcc97f6d91c14d5399d13a73365 (SVN r1918600).
  • CVE-2024-39573
• SECURITY UPDATE: insufficient escaping of mod_ssl variables written to the log by CustomLog
  • debian/patches/CVE-2024-47252.patch: pass the results of ssl_var_log_handler_c() and ssl_var_log_handler_x() through ap_escape_logitem() in modules/ssl/ssl_engine_vars.c, so an untrusted TLS client can no longer insert escape characters into log files through the %{varname}c and %{varname}x formats logging mod_ssl variables such as SSL_TLS_SNI. Upstream fix c01e60707048be14a510f0a92128a5227923215c (SVN r1927042).
  • CVE-2024-47252
• SECURITY UPDATE: access control bypass by trusted clients through TLS 1.3 session resumption in mod_ssl
  • debian/patches/CVE-2025-23048.patch: move the ssl_server_compatible() check in ssl_hook_ReadReq() in modules/ssl/ssl_engine_kernel.c out of the SNI-present branch, so the handshake virtual host and the request virtual host are compared even when the client sent no SNI, as happens on a resumed TLS 1.3 session; previously such a request could reach a virtual host with different client certificate restrictions when SSLStrictSNIVHostCheck was off. Upstream fix c4cfa50c9068e8b8134c530ab21674e77d1278a2 (SVN r1927043).
  • CVE-2025-23048
• SECURITY UPDATE: denial of service through an assertion failure in mod_proxy_http2
  • debian/patches/CVE-2025-49630.patch: fall back to the server hostname when ProxyPreserveHost is on but the incoming request carried no Host: header, in open_stream() in modules/http2/h2_proxy_session.c, instead of passing a NULL authority on to the HTTP/2 backend and tripping an assertion. Upstream fix 88304321841a2fe8bd5eacc70e69418b0b545ca5 (SVN r1927044).
  • CVE-2025-49630
• SECURITY UPDATE: query string passed by mod_cgid to Server Side Includes #exec cmd= commands
  • debian/patches/CVE-2025-58098.patch: pass NULL instead of r->args to create_argv() for SSI_REQ requests in cgid_server(), and tolerate a NULL args in create_argv(), in modules/generators/mod_cgid.c; otherwise the shell-escaped query string is appended as arguments to the command line of an SSI "#exec cmd=..." directive. Upstream fix ecc1b8f3817e3dcab9c1f24f905752d3c0a279af (SVN r1930161).
  • CVE-2025-58098
• SECURITY UPDATE: integer overflow in the mod_md ACME renewal backoff timer
  • debian/patches/CVE-2025-55753.patch: double the retry delay step by step with an overflow and cap check in md_job_delay_on_errors() in modules/md/md_status.c instead of shifting job->min_delay left by err_count-1 in one go; otherwise after roughly 30 days of consecutive renewal failures the shift wraps the signed apr_time_t, the backoff collapses to 0 and the server retries against the ACME CA in a tight loop. Upstream fix 20666cfb765b8ad14efa3d97bc92d344b9395c89 (SVN r1929515).
  • CVE-2025-55753

• rebase to 2.4.6-99.0.9.el7_9.1
• replace the TuxCare backports for CVE-2024-47252, CVE-2025-49812 and CVE-2025-58098 (Patch326-328) with the vendor's own patches (Patch400-402), which carry the identical upstream changes
• all other TuxCare CVE patches are unchanged: Patch300-330 and Patch1000-1014 remain declared and applied

• rebase to 2.4.6-99.0.9.el7_9.1
• replace the TuxCare backports for CVE-2024-47252, CVE-2025-49812 and CVE-2025-58098 (Patch326-328) with the vendor's own patches (Patch400-402), which carry the identical upstream changes
• all other TuxCare CVE patches are unchanged: Patch300-330 and Patch1000-1014 remain declared and applied