CVE-2025-65082

Medium CVSS: 6.5

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.

This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.

Users are recommended to upgrade to version 2.4.66 which fixes the issue.

Vendor

Apache

Product

Http Server

CWE

CWE-150

Yayın Tarihi

2025-12-05 11:15:52

Güncelleme

2025-12-10 16:39:56

Source Identifier

security@apache.org

KEV Date Added

Kategoriler

CWE-150 Http Server MEDIUM Apache 2025

Referanslar

https://httpd.apache.org/security/vulnerabilities_24.html http://www.openwall.com/lists/oss-security/2025/12/04/7

Benzer Kayıtlar

High

CVE-2025-65114

Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Se…

High

CVE-2025-58136

A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from…

Medium

CVE-2026-32794

Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate…

Low

CVE-2026-32642

Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application us…

Medium

CVE-2026-26929

Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filterin…

Medium

CVE-2026-28563

Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filt…