Apache 2.4.x < 2.4.64 Multiple Vulnerabilities

Apache HTTP Server 2.4.64 (released July 10, 2025) patches eight CVEs spanning versions 2.4.0 through 2.4.63. The bugs include: CVE-2025-53020 — an unauthenticated HTTP/2 memory-exhaustion DoS (CWE-401, NVD 7.5 HIGH); CVE-2024-42516 — HTTP response splitting via Content-Type manipulation (moderate, a re-fix of CVE-2023-38709); CVE-2025-23048 — TLS 1.3 session-resumption access-control bypass in multi-vhost mod_ssl setups; CVE-2025-49812 — MitM session hijack on the rare SSLEngine optional TLS-upgrade path; CVE-2024-43394 — Windows-only SSRF that leaks NTLM hashes via mod_rewrite; CVE-2025-49630 — mod_proxy_http2 assertion DoS requiring ProxyPreserveHost on; CVE-2024-43204 — SSRF needing an unlikely mod_headers Content-Type rewrite; and CVE-2024-47252 — log-injection via unescaped mod_ssl variables. None of these yields remote code execution.

Tenable's plugin rolls all eight into a single CVSS 9.1 Critical rating — a scanner artifact of aggregation, not a reflection of any single exploitable chain. Apache itself rates every one of these Moderate or Low. Tenable's own VPR (Vulnerability Priority Rating) quietly agrees: 5.0 / Medium. The vendor severity label of Critical is misleading for triage; the real exposure is an unauthenticated remote DoS against HTTP/2-enabled instances and narrow-condition response-splitting, which lands this squarely in HIGH territory — serious enough to prioritize, but not drop-everything Critical.

Why this verdict

• No RCE in the bundle: All 8 CVEs cap out at DoS, response splitting, SSRF, or access-control bypass. Tenable's 9.1 implies confidentiality+integrity impact that simply does not exist in any single CVE here.
• Aggregation inflation: Tenable composites 8 Moderate/Low CVEs into one Critical plugin. Apache's own ratings — the vendor who wrote the code — top out at Moderate. Tenable's VPR (5.0 Medium) contradicts its own CVSS label.
• Configuration-dependent chains: CVE-2025-49630 needs ProxyPreserveHost on with HTTP/2 backend. CVE-2025-49812 needs SSLEngine optional. CVE-2025-23048 needs multi-vhost client-cert with TLS 1.3. CVE-2024-43204 needs mod_headers rewriting Content-Type. These are not default configurations.
• Role multiplier: Apache httpd is canonically deployed as internet-facing infrastructure (high-value network-edge role). The CVE-2025-53020 DoS chain succeeds in this role with blast radius of service-availability impact per host. However, DoS against a single Apache instance does not cascade to domain takeover, fleet compromise, or supply-chain pivot — it is a per-host availability event, recoverable by restart. This floors the verdict at HIGH but does not reach CRITICAL.
• No exploitation evidence: Zero KEV entries, no known campaigns, no weaponized exploit kits. EPSS for the lead CVE is 4.80% (91st percentile) — elevated but not alarming.

Why not higher?

The path to CRITICAL requires either (a) remote code execution, (b) active mass exploitation, or (c) a chain that ends in fleet/domain compromise from a canonical high-value role. None of the 8 CVEs achieves code execution. The worst unauthenticated outcome is memory-exhaustion DoS, which is recoverable and does not grant persistence or lateral movement. No KEV listing and no in-the-wild campaigns further argue against Critical.

Why not lower?

Apache httpd's massive internet-facing footprint means CVE-2025-53020's unauthenticated remote DoS is reachable against millions of hosts with zero prerequisites. An availability-only attack against a canonical edge component with EPSS in the 91st percentile cannot be dismissed as Medium. The response-splitting issue (CVE-2024-42516) also has real cache-poisoning potential in proxied architectures. The combination of broad exposure and multiple viable (if configuration-dependent) attack surfaces keeps this at HIGH.

1. Disable HTTP/2 if not required — Setting Protocols h2 http/1.1 to just Protocols http/1.1 in your Apache config eliminates the CVE-2025-53020 DoS surface entirely. This is the single highest-value mitigation. Deploy within the noisgate mitigation SLA of 30 days for HIGH.
2. Place Apache behind a CDN or reverse proxy that terminates HTTP/2 — If you need HTTP/2 for clients, terminate it at Cloudflare/Akamai/AWS ALB and proxy HTTP/1.1 to Apache. This shields Apache's HTTP/2 implementation from direct attacker interaction. Deploy within 30 days.
3. Block outbound SMB (port 445) from web servers — Prevents CVE-2024-43394 NTLM hash exfiltration on Windows deployments. This should already be in place as basic host hardening. Verify within 30 days.
4. Enable SSLStrictSNIVHostCheck on multi-vhost TLS configs — Setting SSLStrictSNIVHostCheck on mitigates CVE-2025-23048's TLS 1.3 session-resumption bypass across virtual hosts with different client-cert CAs.
5. Audit and remove SSLEngine optional directives — The SSLEngine optional TLS-upgrade path is rare and enables CVE-2025-49812 MitM. Remove it unless you have a documented business requirement. Version 2.4.64 removes TLS upgrade support entirely.
6. Deploy WAF rules for CRLF injection in response headers — ModSecurity or cloud WAF rules detecting %0d%0a / CRLF sequences in response headers mitigate CVE-2024-42516 response splitting.

Run this on each Apache host as any user with read access to the httpd binary. Example: bash check_apache_2.4.64.sh or bash check_apache_2.4.64.sh /usr/local/apache2/bin/httpd if your binary is non-standard. No root required.

#!/usr/bin/env bash
# check_apache_2.4.64.sh — Verify Apache httpd is patched for Tenable 241984
# Usage: bash check_apache_2.4.64.sh [/path/to/httpd]
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

HTTPD="${1:-}"
if [ -z "$HTTPD" ]; then
  for candidate in httpd apache2 /usr/sbin/httpd /usr/sbin/apache2 /usr/local/apache2/bin/httpd; do
    if command -v "$candidate" &>/dev/null 2>&1; then
      HTTPD="$candidate"
      break
    fi
  done
fi

if [ -z "$HTTPD" ]; then
  echo "UNKNOWN — could not locate httpd/apache2 binary. Pass path as argument."
  exit 2
fi

VERSION_OUTPUT=$($HTTPD -v 2>/dev/null || true)
VERSION=$(echo "$VERSION_OUTPUT" | grep -oP 'Apache/\K[0-9]+\.[0-9]+\.[0-9]+' | head -1)

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not parse version from: $VERSION_OUTPUT"
  exit 2
fi

echo "Detected Apache httpd version: $VERSION"

# Compare version against 2.4.64
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

if [ "$MAJOR" -lt 2 ]; then
  echo "UNKNOWN — Apache 1.x detected; this check targets 2.4.x"
  exit 2
elif [ "$MAJOR" -eq 2 ] && [ "$MINOR" -lt 4 ]; then
  echo "UNKNOWN — Apache 2.0/2.2 detected; this check targets 2.4.x"
  exit 2
elif [ "$MAJOR" -eq 2 ] && [ "$MINOR" -eq 4 ] && [ "$PATCH" -ge 64 ]; then
  echo "PATCHED — Apache $VERSION >= 2.4.64. Tenable plugin 241984 should not fire."
  exit 0
elif [ "$MAJOR" -eq 2 ] && [ "$MINOR" -eq 4 ] && [ "$PATCH" -lt 64 ]; then
  echo "VULNERABLE — Apache $VERSION < 2.4.64. Affected by CVE-2025-53020, CVE-2024-42516, and 6 others."
  exit 1
else
  # Apache 2.5+ or 3.x — likely fine
  echo "PATCHED — Apache $VERSION is newer than 2.4.x branch."
  exit 0
fi

Sources

1. Tenable Plugin 241984
2. Apache httpd 2.4 Security Vulnerabilities
3. oss-security: CVE fixes in Apache HTTP Server 2.4.64
4. CyberSecurityNews: Apache 2.4.64 Released
5. CVE-2025-53020 Detail — CyberStrike
6. CVE-2025-23048 PoC — GitHub
7. SecurityOnline: Apache 2.4.64 Analysis
8. LinuxSecurity: Apache 2.4.64 Patch Analysis