CVE-2025-54090

Summary

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr …" tests evaluating as "true".

Users are recommended to upgrade to version 2.4.65, which fixes the issue.

Affected Software

Weaknesses

• CWE-253: CWE-253 Incorrect Check of Function Return Value

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

CVE Program Container

Additional References

• https://news.ycombinator.com/item?id=44666896
• https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html
• http://www.openwall.com/lists/oss-security/2025/07/24/2

References

• https://httpd.apache.org/security/vulnerabilities_24.html

• ←Previous
• Next→