{"id":"CVE-2025-54090","aliases":["ALPINE-CVE-2025-54090","AZL-65654","BELL-CVE-2025-54090","BIT-apache-2025-54090","CLSA-2026-1777946314","DEBIAN-CVE-2025-54090","EUVD-2025-22448","GHSA-cjqj-vhhm-xq5x","MGASA-2025-0301","openSUSE-SU-2025:15384-1"],"status":"published","title":"Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64","description":"A bug in Apache HTTP Server 2.4.64 results in all \"RewriteCond expr ...\" tests evaluating as \"true\".\n\n\n\nUsers are recommended to upgrade to version 2.4.65, which fixes the issue.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0088,"percentile":0.59409,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-253"],"published":"2025-07-23T13:19:25Z","modified":"2026-10-28T02:30:36Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"apache2","fixed_in":["2.4.65-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"apache2","fixed_in":["2.4.65-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"apache2","fixed_in":["2.4.65-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"apache2","fixed_in":["2.4.65-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"apache2","fixed_in":["2.4.65-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"apache2","fixed_in":["2.4.65-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"httpd","fixed_in":["2.4.65-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"apache2","fixed_in":["2.4.65-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"apache2","fixed_in":["2.4.65-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"apache2","fixed_in":["2.4.65-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"apache","fixed_in":["2.4.65"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apache2","fixed_in":["2.4.65-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apache2","fixed_in":["2.4.65-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"apache2","fixed_in":["2.4.65-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.65-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.65-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.65-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.65-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.65-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.65-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.65-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.54-r2"},{"fixed":"2.4.65-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.63-r0"},{"fixed":"2.4.65-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.56-r0"},{"fixed":"2.4.65-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"apache","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.64"},{"fixed":"2.4.65"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"httpd-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"mod_lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-4.el9_6.4.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.65-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.65-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.65-1.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.65-1.1"}]}]}],"products":[{"vendor":"apache","product":"http_server"},{"vendor":"apache software foundation","product":"apache http server"}],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["vendor-advisory","Release Notes","article","advisory"]},{"url":"https://news.ycombinator.com/item?id=44666896","tags":["Issue Tracking","Patch","fix","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/07/24/2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54090","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-cjqj-vhhm-xq5x"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-54090","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-54090","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1777946314.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54090.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-54090","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0301.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34464","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/10/2","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/10/3","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/10/4","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/10/6","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/10/7","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/10/8","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/10/9","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/10/10","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/24/2","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54090","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-54090","title":"Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64","description":"A bug in Apache HTTP Server 2.4.64 results in all \"RewriteCond expr ...\" tests evaluating as \"true\".\n\n\n\nUsers are recommended to upgrade to version 2.4.65, which fixes the issue.","status":"published","published":"2025-07-23T13:19:25.273Z","modified":"2025-11-04T21:12:43.771Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-253"],"updated_at":"2026-11-02T14:32:27.603809Z"}],"euvd":[{"id":"EUVD-2025-22448","description":"A bug in Apache HTTP Server 2.4.64 results in all \"RewriteCond expr ...\" tests evaluating as \"true\".\n\n\n\nUsers are recommended to upgrade to version 2.4.65, which fixes the issue.","status":"published","published":"2025-07-23T13:19:25Z","modified":"2025-11-04T21:12:43Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:21.143143Z"}],"ghsa":[{"id":"GHSA-cjqj-vhhm-xq5x","title":"A bug in Apache HTTP Server 2.4.64 results in all \"RewriteCond expr ...\" tests evaluating as ...","description":"A bug in Apache HTTP Server 2.4.64 results in all \"RewriteCond expr ...\" tests evaluating as \"true\".\n\n\n\nUsers are recommended to upgrade to version 2.4.65, which fixes the issue.","status":"published","published":"2025-07-23T15:31:13Z","modified":"2025-11-05T00:31:22Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-253"],"updated_at":"2026-11-02T15:04:38.82847Z"}],"nvd":[{"id":"CVE-2025-54090","description":"A bug in Apache HTTP Server 2.4.64 results in all \"RewriteCond expr ...\" tests evaluating as \"true\".\n\n\n\nUsers are recommended to upgrade to version 2.4.65, which fixes the issue.","status":"published","published":"2025-07-23T14:15:34.177Z","modified":"2026-06-17T09:39:24.25Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-253"],"updated_at":"2026-11-02T14:11:19.382856Z"}],"osv":[{"id":"ALPINE-CVE-2025-54090","description":"A bug in Apache HTTP Server 2.4.64 results in all \"RewriteCond expr ...\" tests evaluating as \"true\".\n\n\n\nUsers are recommended to upgrade to version 2.4.65, which fixes the issue.","status":"published","published":"2025-07-23T14:15:34.177Z","modified":"2026-08-27T22:18:02.991141296Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2025-54090","status":"published","published":"2025-07-24T06:01:53.632638Z","modified":"2026-01-26T09:40:32.648374Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-54090","title":"Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64","description":"A bug in Apache HTTP Server 2.4.64 results in all \"RewriteCond expr ...\" tests evaluating as \"true\".\n\n\n\nUsers are recommended to upgrade to version 2.4.65, which fixes the issue.","status":"published","published":"2025-07-23T13:19:25.273Z","modified":"2026-10-28T02:30:36.546975452Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-253"],"updated_at":"2026-11-02T15:44:50.863921Z"},{"id":"DEBIAN-CVE-2025-54090","description":"A bug in Apache HTTP Server 2.4.64 results in all \"RewriteCond expr ...\" tests evaluating as \"true\".    Users are recommended to upgrade to version 2.4.65, which fixes the issue.","status":"published","published":"2025-07-23T14:15:34.177Z","modified":"2026-09-01T20:05:54.440205164Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"AZL-65654","title":"CVE-2025-54090 affecting package httpd for versions less than 2.4.65-1","description":"A bug in Apache HTTP Server 2.4.64 results in all \"RewriteCond expr ...\" tests evaluating as \"true\".\n\n\n\nUsers are recommended to upgrade to version 2.4.65, which fixes the issue.","status":"published","published":"2025-07-23T14:15:34Z","modified":"2026-04-21T04:56:16.228728Z","updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"BIT-apache-2025-54090","title":"Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64","description":"A bug in Apache HTTP Server 2.4.64 results in all \"RewriteCond expr ...\" tests evaluating as \"true\".\n\n\n\nUsers are recommended to upgrade to version 2.4.65, which fixes the issue.","status":"published","published":"2025-07-29T05:38:18.535Z","modified":"2026-09-08T08:45:44.870454059Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"CLSA-2026-1777946314","title":"httpd: Fix of 4 CVEs","description":"- CVE-2024-42516: fix HTTP response splitting in core via Content-Type response header (header_filter rewrite)\n- CVE-2024-43204: prevent SSRF via mod_headers RequestHeader set/edit Content-Type modifying response headers\n- CVE-2024-43394: expand UNC path checking with new ap_stat_check helper (Linux: defense-in-depth no-op);\n  fold in upstream fix for CVE-2025-54090 (RewriteCond expr always evaluating true regression)","status":"published","published":"2026-05-05T01:58:42Z","modified":"2026-06-01T00:32:51.113716089Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"MGASA-2025-0301","title":"Updated apache packages fix security vulnerabilities","description":"HTTP response splitting. (CVE-2024-42516)\nSSRF with mod_headers setting Content-Type header. (CVE-2024-43204)\nmod_ssl error log variable escaping. (CVE-2024-47252)\nmod_proxy_http2 denial of service. (CVE-2025-49630)\nmod_ssl access control bypass with session resumption. (CVE-2025-23048)\nmod_ssl TLS upgrade attack. (CVE-2025-49812)\nHTTP/2 DoS by Memory Increase. (CVE-2025-53020)\n'RewriteCond expr' always evaluates to true in 2.4.64. (CVE-2025-54090)\nYou will find the update delay sometimes causes a failure; just restart\nthe service after the update.\n","status":"published","published":"2025-11-18T02:47:26Z","modified":"2026-04-16T04:42:47.067838817Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15384-1","title":"apache2-2.4.65-1.1 on GA media","description":"These are all security issues fixed in the apache2-2.4.65-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-25T00:00:00Z","modified":"2026-03-23T04:53:42.349276Z","updated_at":"2026-11-02T16:58:37.810934Z"}]}}