RHSA-2025:15619MediumCVSS 7.5

Red Hat Security Advisory: httpd:2.4 security update

Published
September 10, 2025
Last Modified
September 21, 2026

🔗 CVE IDs covered (4)

CVE-2024-47252 →CVE-2025-23048 →CVE-2025-49630 →CVE-2025-49812 →

📋 Description

CVE-2024-47252 — httpd: insufficient escaping of user-supplied data in mod_ssl CVE-2025-23048 — httpd: mod_ssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption CVE-2025-49630 — httpd: mod_proxy_http2: untrusted input from a client causes an assertion to fail in the Apache mod_proxy_http2 module CVE-2025-49812 — httpd: HTTP Session Hijack via a TLS upgrade

🎯 Affected products46

  • Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • httpd-0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • httpd-0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.src (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • httpd-0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • httpd-debuginfo-0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • httpd-debuginfo-0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • httpd-debugsource-0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • httpd-debugsource-0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • httpd-devel-0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • httpd-devel-0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • httpd-filesystem-0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.noarch (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • httpd-manual-0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.noarch (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • httpd-tools-0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • httpd-tools-0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • httpd-tools-debuginfo-0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • httpd-tools-debuginfo-0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • mod_http2-0:1.15.7-8.module+el8.8.0+23464+a2e0c444.6.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • mod_http2-0:1.15.7-8.module+el8.8.0+23464+a2e0c444.6.src (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • mod_http2-0:1.15.7-8.module+el8.8.0+23464+a2e0c444.6.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • mod_http2-debuginfo-0:1.15.7-8.module+el8.8.0+23464+a2e0c444.6.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • mod_http2-debuginfo-0:1.15.7-8.module+el8.8.0+23464+a2e0c444.6.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • mod_http2-debugsource-0:1.15.7-8.module+el8.8.0+23464+a2e0c444.6.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • mod_http2-debugsource-0:1.15.7-8.module+el8.8.0+23464+a2e0c444.6.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • mod_ldap-0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • mod_ldap-0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • mod_ldap-debuginfo-0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • mod_ldap-debuginfo-0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.src (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • +16 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.

🔗 References (7)