7.5

CVE-2025-49630: apache software foundation apache http server Reachable Assertion

CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2025-49630RHSA-2025:14625RHSA-2025:14983
Published 10-07-2025Last modified 04-11-2025
Open JSON

Vulnerability summary

CVE-2025-49630 is a high (CVSS 7.5) Reachable Assertion vulnerability in apache software foundation apache http server. EPSS estimates a 1.35% chance of exploitation in the next 30 days, higher than 71% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
1.35%
0%100%
Low · +0.15 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 17 · Related 9
DLA-4270-1MGASA-2025-0301OPENSUSE-SU-2025:15360-1RHSA-2025:13680RHSA-2025:15123RHSA-2025:15516

Timeline

  1. 10-07-2025
    PublishedVulnerability first disclosed.
  2. 04-11-2025
    Last modifiedVulnerability information updated.

Description

In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2. Configurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to "on".

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

1.35%

Chance of exploitation in the next 30 days

Percentile

71%

Versus all other CVEs

30-day change

+0.15 pp

From 1.21% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.35%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat3 products
  • mod_http2< 0:2.0.29-2.el10_0.1 | < 0:2.0.26-4.el9_6.1 | < 0:1.15.19-3.el9_0.7 | < 0:1.15.19-4.el9_2.7 | < 0:2.0.26-2.el9_4.2
  • mod_http2-debuginfo< 0:2.0.29-2.el10_0.1 | < 0:2.0.26-4.el9_6.1 | < 0:1.15.19-3.el9_0.7 | < 0:1.15.19-4.el9_2.7 | < 0:2.0.26-2.el9_4.2
  • mod_http2-debugsource< 0:2.0.29-2.el10_0.1 | < 0:2.0.26-4.el9_6.1 | < 0:1.15.19-3.el9_0.7 | < 0:1.15.19-4.el9_2.7 | < 0:2.0.26-2.el9_4.2
Alpine1 product
  • apache2< 2.4.64-r0
Apache1 product
Apache software foundation1 product
Debian1 product
  • apache2< 2.4.65-1~deb12u1 | < 2.4.64-1
Ubuntu1 product
  • apache2< 2.4.29-1ubuntu4.27+esm6 | < 2.4.41-4ubuntu3.23+esm2 | < 2.4.52-1ubuntu4.15 | < 2.4.58-1ubuntu8.7

6 vendors · 8 products

References

25 links
Show all 25 references