USN-6885-6
apache2 regression
USN-6885-1 fixed vulnerabilities in Apache. The patch for CVE-2024-38474 was incomplete and caused a regression. This update provides the fix for this issue.
Original advisory details:
Orange Tsai discovered that the Apache HTTP Server mod_rewrite module incorrectly handled certain substitutions. A remote attacker could possibly use this issue to execute scripts in directories not directly reachable by any URL, or cause a denial of service. Some environments may require using the new UnsafeAllow3F flag to handle unsafe substitutions. (CVE-2024-38474)
What each source reports
OSV No score
apache2 regression
USN-6885-1 fixed vulnerabilities in Apache. The patch for CVE-2024-38474 was incomplete and caused a regression. This update provides the fix for this issue.
Original advisory details:
Orange Tsai discovered that the Apache HTTP Server mod_rewrite module incorrectly handled certain substitutions. A remote attacker could possibly use this issue to execute scripts in directories not directly reachable by any URL, or cause a denial of service. Some environments may require using the new UnsafeAllow3F flag to handle unsafe substitutions. (CVE-2024-38474)
- Record
USN-6885-6- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache2Ubuntu:22.04:LTS |
before 2.4.52-1ubuntu4.16, plus listed versions 2.4.48-3.1ubuntu32.4.48-3.1ubuntu42.4.51-2ubuntu12.4.52-1ubuntu12.4.52-1ubuntu2 Show 16 moreShow less2.4.52-1ubuntu42.4.52-1ubuntu4.12.4.52-1ubuntu4.22.4.52-1ubuntu4.32.4.52-1ubuntu4.42.4.52-1ubuntu4.52.4.52-1ubuntu4.62.4.52-1ubuntu4.72.4.52-1ubuntu4.82.4.52-1ubuntu4.92.4.52-1ubuntu4.102.4.52-1ubuntu4.112.4.52-1ubuntu4.122.4.52-1ubuntu4.132.4.52-1ubuntu4.142.4.52-1ubuntu4.15 |
2.4.52-1ubuntu4.16 |
apache2Ubuntu:24.04:LTS |
before 2.4.58-1ubuntu8.8, plus listed versions 2.4.57-2ubuntu22.4.57-2ubuntu32.4.58-1ubuntu12.4.58-1ubuntu22.4.58-1ubuntu6 Show 9 moreShow less2.4.58-1ubuntu72.4.58-1ubuntu82.4.58-1ubuntu8.12.4.58-1ubuntu8.22.4.58-1ubuntu8.32.4.58-1ubuntu8.42.4.58-1ubuntu8.52.4.58-1ubuntu8.62.4.58-1ubuntu8.7 |
2.4.58-1ubuntu8.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-6885-6 is a vulnerability with no CVSS score yet in apache2, published August 13, 2025. No source lists public exploit code. Fixed in apache2 2.4.52-1ubuntu4.16.