CVE-2025-54090
BaseFortify
Publication date: 2025-07-23
Last updated on: 2025-11-04
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | http_server | 2.4.64 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-253 | The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a bug in Apache HTTP Server version 2.4.64 where all "RewriteCond expr ..." tests incorrectly evaluate as "true". This means that conditional rewrite rules that rely on these expressions may not function as intended.
How can this vulnerability impact me? :
Because all "RewriteCond expr ..." tests evaluate as "true", this can lead to unintended behavior in URL rewriting rules, potentially allowing unauthorized access or bypassing intended restrictions, which may compromise the confidentiality, integrity, and availability of the web server.
What immediate steps should I take to mitigate this vulnerability?
Users are recommended to upgrade Apache HTTP Server to version 2.4.65, which fixes the issue.