Apache 2.4.x < 2.4.64 Multiple Vulnerabilities

Apache HTTP Server 2.4.64 (released July 10, 2025) patches eight CVEs spanning versions 2.4.0 through 2.4.63. The bugs include: CVE-2025-53020 — an unauthenticated HTTP/2 memory-exhaustion DoS (CWE-401, NVD 7.5 HIGH); CVE-2024-42516 — HTTP response splitting via Content-Type manipulation (moderate, a re-fix of CVE-2023-38709); CVE-2025-23048 — TLS 1.3 session-resumption access-control bypass in multi-vhost mod_ssl setups; CVE-2025-49812 — MitM session hijack on the rare SSLEngine optional TLS-upgrade path; CVE-2024-43394 — Windows-only SSRF that leaks NTLM hashes via mod_rewrite; CVE-2025-49630 — mod_proxy_http2 assertion DoS requiring ProxyPreserveHost on; CVE-2024-43204 — SSRF needing an unlikely mod_headers Content-Type rewrite; and CVE-2024-47252 — log-injection via unescaped mod_ssl variables. None of these yields remote code execution.

Tenable's plugin rolls all eight into a single CVSS 9.1 Critical rating — a scanner artifact of aggregation, not a reflection of any single exploitable chain. Apache itself rates every one of these Moderate or Low. Tenable's own VPR (Vulnerability Priority Rating) quietly agrees: 5.0 / Medium. The vendor severity label of Critical is misleading for triage; the real exposure is an unauthenticated remote DoS against HTTP/2-enabled instances and narrow-condition response-splitting, which lands this squarely in HIGH territory — serious enough to prioritize, but not drop-everything Critical.

Sources.

1. Tenable Plugin 241984
2. Apache httpd 2.4 Security Vulnerabilities
3. oss-security: CVE fixes in Apache HTTP Server 2.4.64
4. CyberSecurityNews: Apache 2.4.64 Released
5. CVE-2025-53020 Detail — CyberStrike
6. CVE-2025-23048 PoC — GitHub
7. SecurityOnline: Apache 2.4.64 Analysis
8. LinuxSecurity: Apache 2.4.64 Patch Analysis

Run this on each Apache host as any user with read access to the httpd binary. Example: bash check_apache_2.4.64.sh or bash check_apache_2.4.64.sh /usr/local/apache2/bin/httpd if your binary is non-standard. No root required.

#!/usr/bin/env bash
# check_apache_2.4.64.sh — Verify Apache httpd is patched for Tenable 241984
# Usage: bash check_apache_2.4.64.sh [/path/to/httpd]
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

HTTPD="${1:-}"
if [ -z "$HTTPD" ]; then
  for candidate in httpd apache2 /usr/sbin/httpd /usr/sbin/apache2 /usr/local/apache2/bin/httpd; do
    if command -v "$candidate" &>/dev/null 2>&1; then
      HTTPD="$candidate"
      break
    fi
  done
fi

if [ -z "$HTTPD" ]; then
  echo "UNKNOWN — could not locate httpd/apache2 binary. Pass path as argument."
  exit 2
fi

VERSION_OUTPUT=$($HTTPD -v 2>/dev/null || true)
VERSION=$(echo "$VERSION_OUTPUT" | grep -oP 'Apache/\K[0-9]+\.[0-9]+\.[0-9]+' | head -1)

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not parse version from: $VERSION_OUTPUT"
  exit 2
fi

echo "Detected Apache httpd version: $VERSION"

# Compare version against 2.4.64
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

if [ "$MAJOR" -lt 2 ]; then
  echo "UNKNOWN — Apache 1.x detected; this check targets 2.4.x"
  exit 2
elif [ "$MAJOR" -eq 2 ] && [ "$MINOR" -lt 4 ]; then
  echo "UNKNOWN — Apache 2.0/2.2 detected; this check targets 2.4.x"
  exit 2
elif [ "$MAJOR" -eq 2 ] && [ "$MINOR" -eq 4 ] && [ "$PATCH" -ge 64 ]; then
  echo "PATCHED — Apache $VERSION >= 2.4.64. Tenable plugin 241984 should not fire."
  exit 0
elif [ "$MAJOR" -eq 2 ] && [ "$MINOR" -eq 4 ] && [ "$PATCH" -lt 64 ]; then
  echo "VULNERABLE — Apache $VERSION < 2.4.64. Affected by CVE-2025-53020, CVE-2024-42516, and 6 others."
  exit 1
else
  # Apache 2.5+ or 3.x — likely fine
  echo "PATCHED — Apache $VERSION is newer than 2.4.x branch."
  exit 0
fi