The release of Apache HTTP Server 2.4.64 has been presented, addressing 8 vulnerabilities and introducing 19 changes.
Resolved vulnerabilities (the first 4 have a moderate level of severity, and the rest are low):
- CVE-2024-42516 — a potential attack vector through HTTP response splitting on front-end-back-end systems, allowing for the splitting of the Content-Type header in responses to inject content into the responses of other users processed in the same thread between the front end and back end.
- CVE-2024-43394 — a Windows-specific SSRF (Server-Side Request Forgery) vulnerability that, when sending specially crafted requests, may lead to the leaking of NTLM hashes to server, controlled by the attacker.
- CVE-2025-53020 — denial of service via HTTP/2, leading to excessive memory consumption.
- CVE-2025-49812 — a vulnerability in mod_ssl that allows an attacker controlling the traffic (MITM) to perform session hijacking while transitioning from HTTP to HTTPS.
- CVE-2025-23048 — bypassing access restrictions in mod_ssl when recovering an interrupted session.
- CVE-2025-49630 — denial of service leading to a crash of the mod_proxy_http2 module.
- CVE-2024-47252 — incorrect escaping of characters in mod_ssl error information written to the log.
- CVE-2024-43204 — SSRF vulnerability in mod_headers allowing outgoing requests in mod_proxy to be sent to an address specified by the attacker.
The mod_md module with ACME protocol implementation has been updated to version 2.6.6:
- Support for socket activation has been added to mod_systemd.
- The mod_http2 module has added the H2MaxHeaderBlockLen directive to limit the size of HTTP headers in responses.
- The mod_http2 module now records HTTP/2 request duration information.
- The mod_md module has added directives DProfile and MDProfileMandatory to support the ACME protocol extension for certificate profiles.
Source: opennet.ru
