CVE-2025-65082

Summary

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.

This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.

Users are recommended to upgrade to version 2.4.66 which fixes the issue.

Affected Software

Weaknesses

• CWE-150: CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences

ADP Enrichment

CVE Program Container

Additional References

• http://www.openwall.com/lists/oss-security/2025/12/04/7

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://httpd.apache.org/security/vulnerabilities_24.html

• ←Previous
• Next→