CVE-2023-25690: Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

Modified

AliasesALPINE-CVE-2023-25690SUSE-SU-2023:0803-1RHSA-2023:1547+11 more

Published 07-03-2023Last modified 18-12-2025

Vulnerability summary

CVE-2023-25690 is a critical (CVSS 9.8) vulnerability in apache software foundation apache http server. EPSS estimates a 84.51% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 9.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 85% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.1 (CVE.org)

EPSS score

84.51%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 7

DLA-3401-1 DSA-5376-1 MGASA-2023-0100 OPENSUSE-SU-2024:12776-1 RHSA-2023:3354 SUSE-SU-2023:0764-1+5 more

Timeline

07-03-2023
PublishedVulnerability first disclosed.
18-12-2025
Last modifiedVulnerability information updated.

Description

Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/ Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.

CVSS metrics

6 scores · 6 sources · 1 version

v3.19.8

EPSS trend

Probability

84.51%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 84.51% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-444Inconsistent Interpretation of HTTP RequestsThe product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat35 products

httpd< 0:2.4.37-16.module+el8.1.0+18511+ffefe478.6 | < 0:2.4.6-98.el7_9.7 | < 0:2.4.37-39.module+el8.4.0+18509+78723510.6 | < 0:2.4.37-47.module+el8.6.0+18507+843660a1.4 | < 0:2.4.53-7.el9_1.5 | < 0:2.4.37-21.module+el8.2.0+18510+68528e70.6 | < 0:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | < 0:2.4.51-7.el9_0.4
httpd-core< 0:2.4.53-7.el9_1.5
httpd-core-debuginfo< 0:2.4.53-7.el9_1.5
httpd-debuginfo< 0:2.4.37-16.module+el8.1.0+18511+ffefe478.6 | < 0:2.4.6-98.el7_9.7 | < 0:2.4.37-39.module+el8.4.0+18509+78723510.6 | < 0:2.4.37-47.module+el8.6.0+18507+843660a1.4 | < 0:2.4.53-7.el9_1.5 | < 0:2.4.37-21.module+el8.2.0+18510+68528e70.6 | < 0:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | < 0:2.4.51-7.el9_0.4
httpd-debugsource< 0:2.4.37-16.module+el8.1.0+18511+ffefe478.6 | < 0:2.4.37-39.module+el8.4.0+18509+78723510.6 | < 0:2.4.37-47.module+el8.6.0+18507+843660a1.4 | < 0:2.4.53-7.el9_1.5 | < 0:2.4.37-21.module+el8.2.0+18510+68528e70.6 | < 0:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | < 0:2.4.51-7.el9_0.4

httpd-devel< 0:2.4.37-16.module+el8.1.0+18511+ffefe478.6 | < 0:2.4.6-98.el7_9.7 | < 0:2.4.37-39.module+el8.4.0+18509+78723510.6 | < 0:2.4.37-47.module+el8.6.0+18507+843660a1.4 | < 0:2.4.53-7.el9_1.5 | < 0:2.4.37-21.module+el8.2.0+18510+68528e70.6 | < 0:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | < 0:2.4.51-7.el9_0.4
httpd-filesystem< 0:2.4.37-16.module+el8.1.0+18511+ffefe478.6 | < 0:2.4.37-39.module+el8.4.0+18509+78723510.6 | < 0:2.4.37-47.module+el8.6.0+18507+843660a1.4 | < 0:2.4.53-7.el9_1.5 | < 0:2.4.37-21.module+el8.2.0+18510+68528e70.6 | < 0:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | < 0:2.4.51-7.el9_0.4
httpd-manual< 0:2.4.37-16.module+el8.1.0+18511+ffefe478.6 | < 0:2.4.6-98.el7_9.7 | < 0:2.4.37-39.module+el8.4.0+18509+78723510.6 | < 0:2.4.37-47.module+el8.6.0+18507+843660a1.4 | < 0:2.4.53-7.el9_1.5 | < 0:2.4.37-21.module+el8.2.0+18510+68528e70.6 | < 0:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | < 0:2.4.51-7.el9_0.4
httpd-tools< 0:2.4.37-16.module+el8.1.0+18511+ffefe478.6 | < 0:2.4.6-98.el7_9.7 | < 0:2.4.37-39.module+el8.4.0+18509+78723510.6 | < 0:2.4.37-47.module+el8.6.0+18507+843660a1.4 | < 0:2.4.53-7.el9_1.5 | < 0:2.4.37-21.module+el8.2.0+18510+68528e70.6 | < 0:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | < 0:2.4.51-7.el9_0.4
httpd-tools-debuginfo< 0:2.4.37-16.module+el8.1.0+18511+ffefe478.6 | < 0:2.4.37-39.module+el8.4.0+18509+78723510.6 | < 0:2.4.37-47.module+el8.6.0+18507+843660a1.4 | < 0:2.4.53-7.el9_1.5 | < 0:2.4.37-21.module+el8.2.0+18510+68528e70.6 | < 0:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | < 0:2.4.51-7.el9_0.4
httpd24-httpd< 0:2.4.34-23.el7.6
httpd24-httpd-debuginfo< 0:2.4.34-23.el7.6
httpd24-httpd-devel< 0:2.4.34-23.el7.6
httpd24-httpd-manual< 0:2.4.34-23.el7.6
httpd24-httpd-tools< 0:2.4.34-23.el7.6
httpd24-mod_ldap< 0:2.4.34-23.el7.6
httpd24-mod_proxy_html< 1:2.4.34-23.el7.6
httpd24-mod_session< 0:2.4.34-23.el7.6
httpd24-mod_ssl< 1:2.4.34-23.el7.6
mod_http2< 0:1.11.3-3.module+el8.1.0+18514+ae5f89d3.3 | < 0:1.15.7-3.module+el8.4.0+18512+9c29e63a.2 | < 0:1.15.7-5.module+el8.6.0+18506+34b194fb.2 | < 0:1.15.19-3.el9_1.5 | < 0:1.11.3-3.module+el8.2.0+18513+b6a58d46.3 | < 0:1.15.7-5.module+el8.7.0+18499+2e106f0b.4 | < 0:1.15.19-3.el9_0.5
mod_http2-debuginfo< 0:1.11.3-3.module+el8.1.0+18514+ae5f89d3.3 | < 0:1.15.7-3.module+el8.4.0+18512+9c29e63a.2 | < 0:1.15.7-5.module+el8.6.0+18506+34b194fb.2 | < 0:1.15.19-3.el9_1.5 | < 0:1.11.3-3.module+el8.2.0+18513+b6a58d46.3 | < 0:1.15.7-5.module+el8.7.0+18499+2e106f0b.4 | < 0:1.15.19-3.el9_0.5
mod_http2-debugsource< 0:1.11.3-3.module+el8.1.0+18514+ae5f89d3.3 | < 0:1.15.7-3.module+el8.4.0+18512+9c29e63a.2 | < 0:1.15.7-5.module+el8.6.0+18506+34b194fb.2 | < 0:1.15.19-3.el9_1.5 | < 0:1.11.3-3.module+el8.2.0+18513+b6a58d46.3 | < 0:1.15.7-5.module+el8.7.0+18499+2e106f0b.4 | < 0:1.15.19-3.el9_0.5
mod_ldap< 0:2.4.37-16.module+el8.1.0+18511+ffefe478.6 | < 0:2.4.6-98.el7_9.7 | < 0:2.4.37-39.module+el8.4.0+18509+78723510.6 | < 0:2.4.37-47.module+el8.6.0+18507+843660a1.4 | < 0:2.4.53-7.el9_1.5 | < 0:2.4.37-21.module+el8.2.0+18510+68528e70.6 | < 0:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | < 0:2.4.51-7.el9_0.4
mod_ldap-debuginfo< 0:2.4.37-16.module+el8.1.0+18511+ffefe478.6 | < 0:2.4.37-39.module+el8.4.0+18509+78723510.6 | < 0:2.4.37-47.module+el8.6.0+18507+843660a1.4 | < 0:2.4.53-7.el9_1.5 | < 0:2.4.37-21.module+el8.2.0+18510+68528e70.6 | < 0:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | < 0:2.4.51-7.el9_0.4
mod_lua< 0:2.4.53-7.el9_1.5 | < 0:2.4.51-7.el9_0.4
mod_lua-debuginfo< 0:2.4.53-7.el9_1.5 | < 0:2.4.51-7.el9_0.4
mod_md< 0:2.4.37-16.module+el8.1.0+18511+ffefe478.6 | < 1:2.0.8-8.module+el8.3.0+6814+67d1e611 | < 1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
mod_md-debuginfo< 0:2.4.37-16.module+el8.1.0+18511+ffefe478.6 | < 1:2.0.8-8.module+el8.3.0+6814+67d1e611 | < 1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
mod_md-debugsource< 1:2.0.8-8.module+el8.3.0+6814+67d1e611 | < 1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
mod_proxy_html< 1:2.4.37-16.module+el8.1.0+18511+ffefe478.6 | < 1:2.4.6-98.el7_9.7 | < 1:2.4.37-39.module+el8.4.0+18509+78723510.6 | < 1:2.4.37-47.module+el8.6.0+18507+843660a1.4 | < 1:2.4.53-7.el9_1.5 | < 1:2.4.37-21.module+el8.2.0+18510+68528e70.6 | < 1:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | < 1:2.4.51-7.el9_0.4
mod_proxy_html-debuginfo< 1:2.4.37-16.module+el8.1.0+18511+ffefe478.6 | < 1:2.4.37-39.module+el8.4.0+18509+78723510.6 | < 1:2.4.37-47.module+el8.6.0+18507+843660a1.4 | < 1:2.4.53-7.el9_1.5 | < 1:2.4.37-21.module+el8.2.0+18510+68528e70.6 | < 1:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | < 1:2.4.51-7.el9_0.4
mod_session< 0:2.4.37-16.module+el8.1.0+18511+ffefe478.6 | < 0:2.4.6-98.el7_9.7 | < 0:2.4.37-39.module+el8.4.0+18509+78723510.6 | < 0:2.4.37-47.module+el8.6.0+18507+843660a1.4 | < 0:2.4.53-7.el9_1.5 | < 0:2.4.37-21.module+el8.2.0+18510+68528e70.6 | < 0:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | < 0:2.4.51-7.el9_0.4
mod_session-debuginfo< 0:2.4.37-16.module+el8.1.0+18511+ffefe478.6 | < 0:2.4.37-39.module+el8.4.0+18509+78723510.6 | < 0:2.4.37-47.module+el8.6.0+18507+843660a1.4 | < 0:2.4.53-7.el9_1.5 | < 0:2.4.37-21.module+el8.2.0+18510+68528e70.6 | < 0:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | < 0:2.4.51-7.el9_0.4
mod_ssl< 1:2.4.37-16.module+el8.1.0+18511+ffefe478.6 | < 1:2.4.6-98.el7_9.7 | < 1:2.4.37-39.module+el8.4.0+18509+78723510.6 | < 1:2.4.37-47.module+el8.6.0+18507+843660a1.4 | < 1:2.4.53-7.el9_1.5 | < 1:2.4.37-21.module+el8.2.0+18510+68528e70.6 | < 1:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | < 1:2.4.51-7.el9_0.4
mod_ssl-debuginfo< 1:2.4.37-16.module+el8.1.0+18511+ffefe478.6 | < 1:2.4.37-39.module+el8.4.0+18509+78723510.6 | < 1:2.4.37-47.module+el8.6.0+18507+843660a1.4 | < 1:2.4.53-7.el9_1.5 | < 1:2.4.37-21.module+el8.2.0+18510+68528e70.6 | < 1:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | < 1:2.4.51-7.el9_0.4

Show all 35

Suse6 products

apache2&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 2.4.23-29.97.1
apache2&distro=SUSE Linux Enterprise Server 12 SP4-ESPOS< 2.4.23-29.97.1
apache2&distro=SUSE Linux Enterprise Server 12 SP4-LTSS< 2.4.23-29.97.1
apache2&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 2.4.23-29.97.1
apache2&distro=SUSE OpenStack Cloud 9< 2.4.23-29.97.1

Show all 6

Alpine1 product

apache2< 2.4.56-r0

Apache1 product

http_server≥ 2.4.0, ≤ 2.4.55

Apache software foundation1 product

apache http server≥ 2.4.0, ≤ 2.4.55

Debian1 product

apache2< 2.4.56-1

Ubuntu1 product

apache2All versions (No fix recorded) | < 2.4.18-2ubuntu3.17+esm10 | < 2.4.29-1ubuntu4.27 | < 2.4.41-4ubuntu3.14 | < 2.4.52-1ubuntu4.4

7 vendors · 46 products

References

36 links

Show all 36 references