CVE-2023-25690
apache2: Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through2.4.55 allow a HTTP Request Smuggling attac...
CVE-2023-25690 is fixed in 30 products on 1 platform, first by apache2 2.4.29-1ubuntu4.27, released March 7, 2023. It is not reported as exploited. Patch Radar priority: High.
High
CVSS
9.8
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.8451
99th percentile
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through2.4.55 allow a HTTP Request Smuggling attack.Configurations are affected when mod_proxy is enabled along with some formof RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variablesubstitution. For example, something like:RewriteEngine onRewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P]ProxyPassReverse /here/ http://example.com:8080/Request splitting/smuggling could result in bypass of access controls inthe proxy server, proxying unintended URLs to existing origin servers, andcache poisoning. Users are recommended to update to at least version 2.4.56of Apache HTTP Server.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| apache2 · Debian 12.15 (bookworm) | 2.4.56-1 | DEBIAN-CVE-2023-25690 | Mar 7, 2023 |
| apache2 · Debian 13.5 (trixie) | 2.4.56-1 | DEBIAN-CVE-2023-25690 | Mar 7, 2023 |
| apache2 · Debian 14 | 2.4.56-1 | DEBIAN-CVE-2023-25690 | Mar 7, 2023 |
| apache2 · Ubuntu 18.04.6 LTS (bionic) | 2.4.29-1ubuntu4.27 | apache2 2.4.29-1ubuntu4.27 | Mar 7, 2023 |
| apache2 · Ubuntu 20.04 LTS (focal) | 2.4.41-4ubuntu3.14 | apache2 2.4.41-4ubuntu3.14 | Mar 7, 2023 |
| apache2 · Ubuntu 22.04.1 LTS (jammy) | 2.4.52-1ubuntu4.4 | apache2 2.4.52-1ubuntu4.4 | Mar 7, 2023 |
| apache2 · Ubuntu 24.10 (oracular) | 2.4.55-1ubuntu2 | apache2 2.4.55-1ubuntu2 | Jan 16, 2026 |
| apache2 · Ubuntu 25.04 (plucky) | 2.4.55-1ubuntu2 | apache2 2.4.55-1ubuntu2 | Jan 16, 2026 |
| apache2-bin · Ubuntu 18.04.6 LTS (bionic) | 2.4.29-1ubuntu4.27 | apache2-bin 2.4.29-1ubuntu4.27 | Mar 7, 2023 |
| apache2-bin · Ubuntu 20.04 LTS (focal) | 2.4.41-4ubuntu3.14 | apache2-bin 2.4.41-4ubuntu3.14 | Mar 7, 2023 |
| apache2-bin · Ubuntu 22.04.1 LTS (jammy) | 2.4.52-1ubuntu4.4 | apache2-bin 2.4.52-1ubuntu4.4 | Mar 7, 2023 |
| apache2-bin · Ubuntu 24.10 (oracular) | 2.4.55-1ubuntu2 | apache2-bin 2.4.55-1ubuntu2 | Jan 16, 2026 |
| apache2-bin · Ubuntu 25.04 (plucky) | 2.4.55-1ubuntu2 | apache2-bin 2.4.55-1ubuntu2 | Jan 16, 2026 |
| apache2-data · Ubuntu 18.04.6 LTS (bionic) | 2.4.29-1ubuntu4.27 | apache2-data 2.4.29-1ubuntu4.27 | Mar 7, 2023 |
| apache2-data · Ubuntu 20.04 LTS (focal) | 2.4.41-4ubuntu3.14 | apache2-data 2.4.41-4ubuntu3.14 | Mar 7, 2023 |
| apache2-data · Ubuntu 22.04.1 LTS (jammy) | 2.4.52-1ubuntu4.4 | apache2-data 2.4.52-1ubuntu4.4 | Mar 7, 2023 |
| apache2-data · Ubuntu 24.10 (oracular) | 2.4.55-1ubuntu2 | apache2-data 2.4.55-1ubuntu2 | Jan 16, 2026 |
| apache2-data · Ubuntu 25.04 (plucky) | 2.4.55-1ubuntu2 | apache2-data 2.4.55-1ubuntu2 | Jan 16, 2026 |
| apache2-suexec-custom · Ubuntu 18.04.6 LTS (bionic) | 2.4.29-1ubuntu4.27 | apache2-suexec-custom 2.4.29-1ubuntu4.27 | Mar 7, 2023 |
| apache2-suexec-custom · Ubuntu 20.04 LTS (focal) | 2.4.41-4ubuntu3.14 | apache2-suexec-custom 2.4.41-4ubuntu3.14 | Mar 7, 2023 |
| apache2-suexec-custom · Ubuntu 22.04.1 LTS (jammy) | 2.4.52-1ubuntu4.4 | apache2-suexec-custom 2.4.52-1ubuntu4.4 | Mar 7, 2023 |
| apache2-suexec-custom · Ubuntu 24.10 (oracular) | 2.4.55-1ubuntu2 | apache2-suexec-custom 2.4.55-1ubuntu2 | Jan 16, 2026 |
| apache2-suexec-custom · Ubuntu 25.04 (plucky) | 2.4.55-1ubuntu2 | apache2-suexec-custom 2.4.55-1ubuntu2 | Jan 16, 2026 |
| apache2-suexec-pristine · Ubuntu 18.04.6 LTS (bionic) | 2.4.29-1ubuntu4.27 | apache2-suexec-pristine 2.4.29-1ubuntu4.27 | Mar 7, 2023 |
| apache2-suexec-pristine · Ubuntu 20.04 LTS (focal) | 2.4.41-4ubuntu3.14 | apache2-suexec-pristine 2.4.41-4ubuntu3.14 | Mar 7, 2023 |
| apache2-suexec-pristine · Ubuntu 22.04.1 LTS (jammy) | 2.4.52-1ubuntu4.4 | apache2-suexec-pristine 2.4.52-1ubuntu4.4 | Mar 7, 2023 |
| apache2-suexec-pristine · Ubuntu 24.10 (oracular) | 2.4.55-1ubuntu2 | apache2-suexec-pristine 2.4.55-1ubuntu2 | Jan 16, 2026 |
| apache2-suexec-pristine · Ubuntu 25.04 (plucky) | 2.4.55-1ubuntu2 | apache2-suexec-pristine 2.4.55-1ubuntu2 | Jan 16, 2026 |
| apache2-utils · Ubuntu 18.04.6 LTS (bionic) | 2.4.29-1ubuntu4.27 | apache2-utils 2.4.29-1ubuntu4.27 | Mar 7, 2023 |
| apache2-utils · Ubuntu 20.04 LTS (focal) | 2.4.41-4ubuntu3.14 | apache2-utils 2.4.41-4ubuntu3.14 | Mar 7, 2023 |
| apache2-utils · Ubuntu 22.04.1 LTS (jammy) | 2.4.52-1ubuntu4.4 | apache2-utils 2.4.52-1ubuntu4.4 | Mar 7, 2023 |
| apache2-utils · Ubuntu 24.10 (oracular) | 2.4.55-1ubuntu2 | apache2-utils 2.4.55-1ubuntu2 | Jan 16, 2026 |
| apache2-utils · Ubuntu 25.04 (plucky) | 2.4.55-1ubuntu2 | apache2-utils 2.4.55-1ubuntu2 | Jan 16, 2026 |
| httpd · RHEL 8 | 0:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | RHSA-2023:1673 | Apr 6, 2023 |
| httpd · RHEL 9 | 0:2.4.53-7.el9_1.5 | RHSA-2023:1670 | Apr 6, 2023 |
| httpd · almalinux 8 | 2.4.37-51.module_el8.7.0+3515+9e4fe0d6.5 | ALSA-2023:1673 | Apr 6, 2023 |
| httpd · almalinux 9 | 2.4.53-7.el9_1.5 | ALSA-2023:1670 | Apr 6, 2023 |
| httpd · amzn 2023 | 2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
| httpd · ol 8 | 0:2.4.37-51.0.1.module+el8.7.0+21029+de29ba63.5 | ELSA-2023-1673 | Apr 7, 2023 |
| httpd · ol 9 | 0:2.4.53-7.0.1.el9_1.5 | ELSA-2023-1670 | Apr 6, 2023 |
| httpd · rocky 8 | 0:2.4.37-51.module+el8.7.0+1059+126e9251 | RLSA-2023:1673 | Apr 12, 2023 |
| httpd · rocky 9 | 0:2.4.53-7.el9_1.5 | RLSA-2023:1670 | Apr 12, 2023 |
| httpd-core · RHEL 9 | 0:2.4.53-7.el9_1.5 | RHSA-2023:1670 | Apr 6, 2023 |
| httpd-core · almalinux 9 | 2.4.53-7.el9_1.5 | ALSA-2023:1670 | Apr 6, 2023 |
| httpd-core · amzn 2023 | 2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
| httpd-core · ol 9 | 0:2.4.53-7.0.1.el9_1.5 | ELSA-2023-1670 | Apr 6, 2023 |
| httpd-core-debuginfo · amzn 2023 | 2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
| httpd-debuginfo · amzn 2023 | 2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
| httpd-debugsource · amzn 2023 | 2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
| httpd-devel · RHEL 8 | 0:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | RHSA-2023:1673 | Apr 6, 2023 |
| httpd-devel · RHEL 9 | 0:2.4.53-7.el9_1.5 | RHSA-2023:1670 | Apr 6, 2023 |
| httpd-devel · almalinux 8 | 2.4.37-51.module_el8.7.0+3515+9e4fe0d6.5 | ALSA-2023:1673 | Apr 6, 2023 |
| httpd-devel · almalinux 9 | 2.4.53-7.el9_1.5 | ALSA-2023:1670 | Apr 6, 2023 |
| httpd-devel · amzn 2023 | 2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
| httpd-devel · ol 8 | 0:2.4.37-51.0.1.module+el8.7.0+21029+de29ba63.5 | ELSA-2023-1673 | Apr 7, 2023 |
| httpd-devel · ol 9 | 0:2.4.53-7.0.1.el9_1.5 | ELSA-2023-1670 | Apr 6, 2023 |
| httpd-filesystem · RHEL 8 | 0:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | RHSA-2023:1673 | Apr 6, 2023 |
| httpd-filesystem · RHEL 9 | 0:2.4.53-7.el9_1.5 | RHSA-2023:1670 | Apr 6, 2023 |
| httpd-filesystem · almalinux 8 | 2.4.37-51.module_el8.7.0+3515+9e4fe0d6.5 | ALSA-2023:1673 | Apr 6, 2023 |
| httpd-filesystem · almalinux 9 | 2.4.53-7.el9_1.5 | ALSA-2023:1670 | Apr 6, 2023 |
| httpd-filesystem · amzn 2023 | 2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
| httpd-filesystem · ol 8 | 0:2.4.37-51.0.1.module+el8.7.0+21029+de29ba63.5 | ELSA-2023-1673 | Apr 7, 2023 |
| httpd-filesystem · ol 9 | 0:2.4.53-7.0.1.el9_1.5 | ELSA-2023-1670 | Apr 6, 2023 |
| httpd-manual · RHEL 8 | 0:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | RHSA-2023:1673 | Apr 6, 2023 |
| httpd-manual · RHEL 9 | 0:2.4.53-7.el9_1.5 | RHSA-2023:1670 | Apr 6, 2023 |
| httpd-manual · almalinux 8 | 2.4.37-51.module_el8.7.0+3515+9e4fe0d6.5 | ALSA-2023:1673 | Apr 6, 2023 |
| httpd-manual · almalinux 9 | 2.4.53-7.el9_1.5 | ALSA-2023:1670 | Apr 6, 2023 |
| httpd-manual · amzn 2023 | 2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
| httpd-manual · ol 8 | 0:2.4.37-51.0.1.module+el8.7.0+21029+de29ba63.5 | ELSA-2023-1673 | Apr 7, 2023 |
| httpd-manual · ol 9 | 0:2.4.53-7.0.1.el9_1.5 | ELSA-2023-1670 | Apr 6, 2023 |
| httpd-tools · RHEL 8 | 0:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | RHSA-2023:1673 | Apr 6, 2023 |
| httpd-tools · RHEL 9 | 0:2.4.53-7.el9_1.5 | RHSA-2023:1670 | Apr 6, 2023 |
| httpd-tools · almalinux 8 | 2.4.37-51.module_el8.7.0+3515+9e4fe0d6.5 | ALSA-2023:1673 | Apr 6, 2023 |
| httpd-tools · almalinux 9 | 2.4.53-7.el9_1.5 | ALSA-2023:1670 | Apr 6, 2023 |
| httpd-tools · amzn 2023 | 2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
| httpd-tools · ol 8 | 0:2.4.37-51.0.1.module+el8.7.0+21029+de29ba63.5 | ELSA-2023-1673 | Apr 7, 2023 |
| httpd-tools · ol 9 | 0:2.4.53-7.0.1.el9_1.5 | ELSA-2023-1670 | Apr 6, 2023 |
| httpd-tools-debuginfo · amzn 2023 | 2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
| libapache2-mod-md · Ubuntu 20.04 LTS (focal) | 2.4.41-4ubuntu3.14 | libapache2-mod-md 2.4.41-4ubuntu3.14 | Mar 7, 2023 |
| libapache2-mod-md · Ubuntu 22.04.1 LTS (jammy) | 2.4.52-1ubuntu4.4 | libapache2-mod-md 2.4.52-1ubuntu4.4 | Mar 7, 2023 |
| libapache2-mod-md · Ubuntu 24.10 (oracular) | 2.4.55-1ubuntu2 | libapache2-mod-md 2.4.55-1ubuntu2 | Jan 16, 2026 |
| libapache2-mod-proxy-uwsgi · Ubuntu 20.04 LTS (focal) | 2.4.41-4ubuntu3.14 | libapache2-mod-proxy-uwsgi 2.4.41-4ubuntu3.14 | Mar 7, 2023 |
| libapache2-mod-proxy-uwsgi · Ubuntu 22.04.1 LTS (jammy) | 2.4.52-1ubuntu4.4 | libapache2-mod-proxy-uwsgi 2.4.52-1ubuntu4.4 | Mar 7, 2023 |
| libapache2-mod-proxy-uwsgi · Ubuntu 24.10 (oracular) | 2.4.55-1ubuntu2 | libapache2-mod-proxy-uwsgi 2.4.55-1ubuntu2 | Jan 16, 2026 |
| mod_http2 · RHEL 8 | 0:1.15.7-5.module+el8.7.0+18499+2e106f0b.4 | RHSA-2023:1673 | Apr 6, 2023 |
| mod_http2 · RHEL 9 | 0:1.15.19-3.el9_1.5 | RHSA-2023:1670 | Apr 6, 2023 |
| mod_http2 · almalinux 8 | 1.15.7-5.module_el8.7.0+3515+9e4fe0d6.4 | ALSA-2023:1673 | Apr 6, 2023 |
| mod_http2 · almalinux 9 | 1.15.19-3.el9_1.5 | ALSA-2023:1670 | Apr 6, 2023 |
| mod_http2 · ol 8 | 0:1.15.7-5.module+el8.7.0+21029+de29ba63.4 | ELSA-2023-1673 | Apr 7, 2023 |
| mod_http2 · ol 9 | 0:1.15.19-3.el9_1.5 | ELSA-2023-1670 | Apr 6, 2023 |
| mod_http2 · rocky 8 | 0:1.15.7-5.module+el8.6.0+823+f143cee1 | RLSA-2023:1673 | Apr 12, 2023 |
| mod_http2 · rocky 9 | 0:1.15.19-3.el9_1.5 | RLSA-2023:1670 | Apr 12, 2023 |
| mod_ldap · RHEL 8 | 0:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | RHSA-2023:1673 | Apr 6, 2023 |
| mod_ldap · RHEL 9 | 0:2.4.53-7.el9_1.5 | RHSA-2023:1670 | Apr 6, 2023 |
| mod_ldap · almalinux 8 | 2.4.37-51.module_el8.7.0+3515+9e4fe0d6.5 | ALSA-2023:1673 | Apr 6, 2023 |
| mod_ldap · almalinux 9 | 2.4.53-7.el9_1.5 | ALSA-2023:1670 | Apr 6, 2023 |
| mod_ldap · amzn 2023 | 2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
| mod_ldap · ol 8 | 0:2.4.37-51.0.1.module+el8.7.0+21029+de29ba63.5 | ELSA-2023-1673 | Apr 7, 2023 |
| mod_ldap · ol 9 | 0:2.4.53-7.0.1.el9_1.5 | ELSA-2023-1670 | Apr 6, 2023 |
| mod_ldap-debuginfo · amzn 2023 | 2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
| mod_lua · RHEL 9 | 0:2.4.53-7.el9_1.5 | RHSA-2023:1670 | Apr 6, 2023 |
| mod_lua · almalinux 9 | 2.4.53-7.el9_1.5 | ALSA-2023:1670 | Apr 6, 2023 |
| mod_lua · amzn 2023 | 2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
| mod_lua · ol 9 | 0:2.4.53-7.0.1.el9_1.5 | ELSA-2023-1670 | Apr 6, 2023 |
| mod_lua-debuginfo · amzn 2023 | 2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
| mod_md · RHEL 8 | 1:2.0.8-8.module+el8.3.0+6814+67d1e611 | RHSA-2023:1673 | Apr 6, 2023 |
| mod_md · almalinux 8 | 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa | ALSA-2023:1673 | Apr 6, 2023 |
| mod_md · ol 8 | 1:2.0.8-8.module+el8.5.0+20475+4f6a8fd5 | ELSA-2023-1673 | Apr 7, 2023 |
| mod_md · rocky 8 | 1:2.0.8-8.module+el8.5.0+695+1fa8055e | RLSA-2023:1673 | Apr 12, 2023 |
| mod_proxy_html · RHEL 8 | 1:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | RHSA-2023:1673 | Apr 6, 2023 |
| mod_proxy_html · RHEL 9 | 1:2.4.53-7.el9_1.5 | RHSA-2023:1670 | Apr 6, 2023 |
| mod_proxy_html · almalinux 8 | 1:2.4.37-51.module_el8.7.0+3515+9e4fe0d6.5 | ALSA-2023:1673 | Apr 6, 2023 |
| mod_proxy_html · almalinux 9 | 1:2.4.53-7.el9_1.5 | ALSA-2023:1670 | Apr 6, 2023 |
| mod_proxy_html · amzn 2023 | 1:2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
| mod_proxy_html · ol 8 | 1:2.4.37-51.0.1.module+el8.7.0+21029+de29ba63.5 | ELSA-2023-1673 | Apr 7, 2023 |
| mod_proxy_html · ol 9 | 1:2.4.53-7.0.1.el9_1.5 | ELSA-2023-1670 | Apr 6, 2023 |
| mod_proxy_html-debuginfo · amzn 2023 | 1:2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
| mod_session · RHEL 8 | 0:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | RHSA-2023:1673 | Apr 6, 2023 |
| mod_session · RHEL 9 | 0:2.4.53-7.el9_1.5 | RHSA-2023:1670 | Apr 6, 2023 |
| mod_session · almalinux 8 | 2.4.37-51.module_el8.7.0+3515+9e4fe0d6.5 | ALSA-2023:1673 | Apr 6, 2023 |
| mod_session · almalinux 9 | 2.4.53-7.el9_1.5 | ALSA-2023:1670 | Apr 6, 2023 |
| mod_session · amzn 2023 | 2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
| mod_session · ol 8 | 0:2.4.37-51.0.1.module+el8.7.0+21029+de29ba63.5 | ELSA-2023-1673 | Apr 7, 2023 |
| mod_session · ol 9 | 0:2.4.53-7.0.1.el9_1.5 | ELSA-2023-1670 | Apr 6, 2023 |
| mod_session-debuginfo · amzn 2023 | 2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
| mod_ssl · RHEL 8 | 1:2.4.37-51.module+el8.7.0+18499+2e106f0b.5 | RHSA-2023:1673 | Apr 6, 2023 |
| mod_ssl · RHEL 9 | 1:2.4.53-7.el9_1.5 | RHSA-2023:1670 | Apr 6, 2023 |
| mod_ssl · almalinux 8 | 1:2.4.37-51.module_el8.7.0+3515+9e4fe0d6.5 | ALSA-2023:1673 | Apr 6, 2023 |
| mod_ssl · almalinux 9 | 1:2.4.53-7.el9_1.5 | ALSA-2023:1670 | Apr 6, 2023 |
| mod_ssl · amzn 2023 | 1:2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
| mod_ssl · ol 8 | 1:2.4.37-51.0.1.module+el8.7.0+21029+de29ba63.5 | ELSA-2023-1673 | Apr 7, 2023 |
| mod_ssl · ol 9 | 1:2.4.53-7.0.1.el9_1.5 | ELSA-2023-1670 | Apr 6, 2023 |
| mod_ssl-debuginfo · amzn 2023 | 1:2.4.56-1.amzn2023 | ALAS2023-2023-136 | Mar 20, 2023 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.