Vulnerability-Lookup

OESA-2025-2076 (CVE-2025-49630)

Vulnerability from osv_openeuler – Published: 2025-08-29 11:09 – Updated: 2026-08-06 11:09 – Source website

Summary

mod_http2 security update

Details

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

A vulnerability classified as problematic has been found in Apache HTTP Server up to 2.4.63 (Web Server).CWE is classifying the issue as CWE-617. The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.This is going to have an impact on availability.Upgrading to version 2.4.64 eliminates this vulnerability.The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-21017).(CVE-2025-49630)

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-49630	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "mod_http2-1.15.25-4.oe2203sp3.aarch64.rpm",
          "mod_http2-debuginfo-1.15.25-4.oe2203sp3.aarch64.rpm",
          "mod_http2-debugsource-1.15.25-4.oe2203sp3.aarch64.rpm"
        ],
        "noarch": [
          "mod_http2-help-1.15.25-4.oe2203sp3.noarch.rpm"
        ],
        "src": [
          "mod_http2-1.15.25-4.oe2203sp3.src.rpm"
        ],
        "x86_64": [
          "mod_http2-1.15.25-4.oe2203sp3.x86_64.rpm",
          "mod_http2-debuginfo-1.15.25-4.oe2203sp3.x86_64.rpm",
          "mod_http2-debugsource-1.15.25-4.oe2203sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP3",
        "name": "mod_http2",
        "purl": "pkg:rpm/openEuler/mod_http2\u0026distro=openEuler-22.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.15.25-4.oe2203sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "mod_http2-1.15.25-4.oe2203sp4.aarch64.rpm",
          "mod_http2-debuginfo-1.15.25-4.oe2203sp4.aarch64.rpm",
          "mod_http2-debugsource-1.15.25-4.oe2203sp4.aarch64.rpm"
        ],
        "noarch": [
          "mod_http2-help-1.15.25-4.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "mod_http2-1.15.25-4.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "mod_http2-1.15.25-4.oe2203sp4.x86_64.rpm",
          "mod_http2-debuginfo-1.15.25-4.oe2203sp4.x86_64.rpm",
          "mod_http2-debugsource-1.15.25-4.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "mod_http2",
        "purl": "pkg:rpm/openEuler/mod_http2\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.15.25-4.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "mod_http2-2.0.25-4.oe2403.aarch64.rpm",
          "mod_http2-debuginfo-2.0.25-4.oe2403.aarch64.rpm",
          "mod_http2-debugsource-2.0.25-4.oe2403.aarch64.rpm",
          "mod_http2-2.0.25-4.oe2403sp1.aarch64.rpm",
          "mod_http2-debuginfo-2.0.25-4.oe2403sp1.aarch64.rpm",
          "mod_http2-debugsource-2.0.25-4.oe2403sp1.aarch64.rpm",
          "mod_http2-2.0.25-4.oe2403sp2.aarch64.rpm",
          "mod_http2-debuginfo-2.0.25-4.oe2403sp2.aarch64.rpm",
          "mod_http2-debugsource-2.0.25-4.oe2403sp2.aarch64.rpm"
        ],
        "noarch": [
          "mod_http2-help-2.0.25-4.oe2403.noarch.rpm",
          "mod_http2-help-2.0.25-4.oe2403sp1.noarch.rpm",
          "mod_http2-help-2.0.25-4.oe2403sp2.noarch.rpm"
        ],
        "src": [
          "mod_http2-2.0.25-4.oe2403.src.rpm",
          "mod_http2-2.0.25-4.oe2403sp1.src.rpm",
          "mod_http2-2.0.25-4.oe2403sp2.src.rpm"
        ],
        "x86_64": [
          "mod_http2-2.0.25-4.oe2403.x86_64.rpm",
          "mod_http2-debuginfo-2.0.25-4.oe2403.x86_64.rpm",
          "mod_http2-debugsource-2.0.25-4.oe2403.x86_64.rpm",
          "mod_http2-2.0.25-4.oe2403sp1.x86_64.rpm",
          "mod_http2-debuginfo-2.0.25-4.oe2403sp1.x86_64.rpm",
          "mod_http2-debugsource-2.0.25-4.oe2403sp1.x86_64.rpm",
          "mod_http2-2.0.25-4.oe2403sp2.x86_64.rpm",
          "mod_http2-debuginfo-2.0.25-4.oe2403sp2.x86_64.rpm",
          "mod_http2-debugsource-2.0.25-4.oe2403sp2.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "mod_http2",
        "purl": "pkg:rpm/openEuler/mod_http2\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.25-4.oe2403sp2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "mod_http2-2.0.25-4.oe2403sp1.aarch64.rpm",
          "mod_http2-debuginfo-2.0.25-4.oe2403sp1.aarch64.rpm",
          "mod_http2-debugsource-2.0.25-4.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "mod_http2-help-2.0.25-4.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "mod_http2-2.0.25-4.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "mod_http2-2.0.25-4.oe2403sp1.x86_64.rpm",
          "mod_http2-debuginfo-2.0.25-4.oe2403sp1.x86_64.rpm",
          "mod_http2-debugsource-2.0.25-4.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "mod_http2",
        "purl": "pkg:rpm/openEuler/mod_http2\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.25-4.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "mod_http2-2.0.25-4.oe2403sp2.aarch64.rpm",
          "mod_http2-debuginfo-2.0.25-4.oe2403sp2.aarch64.rpm",
          "mod_http2-debugsource-2.0.25-4.oe2403sp2.aarch64.rpm"
        ],
        "noarch": [
          "mod_http2-help-2.0.25-4.oe2403sp2.noarch.rpm"
        ],
        "src": [
          "mod_http2-2.0.25-4.oe2403sp2.src.rpm"
        ],
        "x86_64": [
          "mod_http2-2.0.25-4.oe2403sp2.x86_64.rpm",
          "mod_http2-debuginfo-2.0.25-4.oe2403sp2.x86_64.rpm",
          "mod_http2-debugsource-2.0.25-4.oe2403sp2.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP2",
        "name": "mod_http2",
        "purl": "pkg:rpm/openEuler/mod_http2\u0026distro=openEuler-24.03-LTS-SP2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.25-4.oe2403sp2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "mod_http2-1.15.13-3.oe2003sp4.aarch64.rpm",
          "mod_http2-debuginfo-1.15.13-3.oe2003sp4.aarch64.rpm",
          "mod_http2-debugsource-1.15.13-3.oe2003sp4.aarch64.rpm"
        ],
        "noarch": [
          "mod_http2-help-1.15.13-3.oe2003sp4.noarch.rpm"
        ],
        "src": [
          "mod_http2-1.15.13-3.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "mod_http2-1.15.13-3.oe2003sp4.x86_64.rpm",
          "mod_http2-debuginfo-1.15.13-3.oe2003sp4.x86_64.rpm",
          "mod_http2-debugsource-1.15.13-3.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "mod_http2",
        "purl": "pkg:rpm/openEuler/mod_http2\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.15.13-3.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.\r\n\r\nSecurity Fix(es):\n\nA vulnerability classified as problematic has been found in Apache HTTP Server up to 2.4.63 (Web Server).CWE is classifying the issue as CWE-617. The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.This is going to have an impact on availability.Upgrading to version 2.4.64 eliminates this vulnerability.The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-21017).(CVE-2025-49630)",
  "id": "OESA-2025-2076",
  "modified": "2026-08-06T11:09:09Z",
  "published": "2025-08-29T11:09:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2076"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49630"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "mod_http2 security update",
  "upstream": [
    "CVE-2025-49630"
  ]
}

CVE-2025-49630 (GCVE-0-2025-49630)

Vulnerability from cvelistv5 – Published: 2025-07-10 16:57 – Updated: 2025-11-04 21:11

Title

Apache HTTP Server: mod_proxy_http2 denial of service

Summary

In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2. Configurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to "on".

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-11 16:06 UTC

CWE

CWE-617 - Reachable Assertion

Assigner

apache mitre root

References

4 references

URL	Tags
https://httpd.apache.org/security/vulnerabilities…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2025…
http://www.openwall.com/lists/oss-security/2025/07/10/2
http://www.openwall.com/lists/oss-security/2025/07/10/7

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: 2.4.26 , ≤ 2.4.63 (semver)

Credits

Anthony CORSIEZ

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-49630",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-11T16:06:07.523613Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-15T19:56:20.614Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:11:13.455Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/07/10/2"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/07/10/7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.4.63",
              "status": "affected",
              "version": "2.4.26",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Anthony CORSIEZ"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In certain proxy configurations, a denial of service attack against\u0026nbsp;Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2.\u003cbr\u003e\u003cbr\u003eConfigurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to \"on\".\u003cbr\u003e"
            }
          ],
          "value": "In certain proxy configurations, a denial of service attack against\u00a0Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2.\n\nConfigurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to \"on\"."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-617",
              "description": "CWE-617 Reachable Assertion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-10T16:57:40.117Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2025-06-04T14:20:00.000Z",
          "value": "Report received"
        }
      ],
      "title": "Apache HTTP Server: mod_proxy_http2 denial of service",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-49630",
    "datePublished": "2025-07-10T16:57:40.117Z",
    "dateReserved": "2025-06-08T19:44:51.747Z",
    "dateUpdated": "2025-11-04T21:11:13.455Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.