CVE-2025-54090
CVE-2025-54090 · Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue.
CVSS 6.3 · Medium · EPSS 0.9% · Fix available
- Published
- Updated
Affected products and versions
apache httpd
- Versions
- 2.4.64: Affected (semver)
No fix published
apache2 Debian:13
- Affected ranges
- ECOSYSTEM: < 2.4.65-1
Update to 2.4.65-1
apache2 Debian:14
- Affected ranges
- ECOSYSTEM: < 2.4.65-1
Update to 2.4.65-1