high CVSS 7.5

CVE-2024-47252·Apache vulnerability

Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.

Severity
high
Software
Apache
Fixed in
2.4.64
Published
2025-07-10

Affected versions

From: 2.4.0

Until: 2.4.64

Fixed in: 2.4.64

How to fix this CVE

Update Apache HTTP Server to version 2.4.64 or later to remediate log injection vulnerabilities in mod_ssl. This patch ensures that SSL/TLS client-supplied data logged via CustomLog directives is properly escaped, preventing escape characters from corrupting log files. Verify the update is applied and restart Apache to activate the security fix.

sudo dnf update -y httpd

Defensia detects this vulnerability

How to check if you are affected

  1. Run 'apache2ctl -v' or 'httpd -v' to check the installed Apache version; vulnerable versions are 2.4.0 through 2.4.63
  2. Check if mod_ssl is enabled by running 'apache2ctl -M | grep ssl_module' or 'httpd -M | grep ssl_module'
  3. Review Apache configuration files for CustomLog directives using '%{varname}x' or '%{varname}c' formatting with SSL variables like SSL_TLS_SNI: grep -r 'CustomLog.*%{.*}[xc]' /etc/apache2/
  4. Verify the patch is applied by confirming Apache version is 2.4.64 or later with 'apache2ctl -v' and restart Apache with 'sudo systemctl restart apache2'

FAQ

What is CVE-2024-47252?

CVE-2024-47252 is a log injection vulnerability in Apache mod_ssl where untrusted SSL/TLS client data (such as SNI hostnames) is written to access logs without proper escaping when CustomLog uses the %{varname}x or %{varname}c directives, potentially corrupting log files with control characters.

Is CVE-2024-47252 being actively exploited?

No, CVE-2024-47252 is not currently listed on the CISA KEV catalog and no public exploits are available, though the vulnerability is straightforward to trigger from any SSL/TLS client connection.

What versions of Apache are affected by CVE-2024-47252?

Apache HTTP Server versions 2.4.0 through 2.4.63 are vulnerable; version 2.4.64 and later contain the fix.

How do I check if my server is vulnerable to CVE-2024-47252?

Run 'apache2ctl -v' and verify the version is 2.4.63 or earlier, then check if mod_ssl is loaded with 'apache2ctl -M | grep ssl_module', and finally search your Apache configs with 'grep -r "CustomLog.*%{.*}[xc]" /etc/apache2/' to see if unescaped SSL variables are being logged.

Does Defensia detect CVE-2024-47252?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Apache is installed on a monitored server, CVE-2024-47252 will appear in your dashboard with remediation steps.

Related Apache CVEs

CVE-2024-38476CVSS 9.8Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
CVE-2024-38474CVSS 9.8Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.
CVE-2024-38475CVSS 9.1Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected.  Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
CVE-2025-23048CVSS 9.1In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.
CVE-2025-58098CVSS 8.3Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-47252. Free for 1 server.

Get started free