high CVSS 7.5 EPSS 0.15%

CVE-2024-47252·Apache vulnerability

Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.

Severity
high
Software
Apache
Fixed in
2.4.64
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.15% — higher than 35% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2024-47252 scores 7.5 on CVSS, so a successful attack would be serious — but at 0.15%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

From: 2.4.0

Until: 2.4.64

Fixed in: 2.4.64

How to fix this CVE

Update Apache HTTP Server to version 2.4.64 or later to remediate log injection vulnerabilities in mod_ssl. This patch ensures that SSL/TLS client-supplied data logged via CustomLog directives is properly escaped, preventing escape characters from corrupting log files. Verify the update is applied and restart Apache to activate the security fix.

sudo dnf update -y httpd

Defensia detects this vulnerability

How to check if you are affected

  1. Run 'apache2ctl -v' or 'httpd -v' to check the installed Apache version; vulnerable versions are 2.4.0 through 2.4.63
  2. Check if mod_ssl is enabled by running 'apache2ctl -M | grep ssl_module' or 'httpd -M | grep ssl_module'
  3. Review Apache configuration files for CustomLog directives using '%{varname}x' or '%{varname}c' formatting with SSL variables like SSL_TLS_SNI: grep -r 'CustomLog.*%{.*}[xc]' /etc/apache2/
  4. Verify the patch is applied by confirming Apache version is 2.4.64 or later with 'apache2ctl -v' and restart Apache with 'sudo systemctl restart apache2'

FAQ

What is CVE-2024-47252?

CVE-2024-47252 is a log injection vulnerability in Apache mod_ssl where untrusted SSL/TLS client data (such as SNI hostnames) is written to access logs without proper escaping when CustomLog uses the %{varname}x or %{varname}c directives, potentially corrupting log files with control characters.

Is CVE-2024-47252 being actively exploited?

No, CVE-2024-47252 is not currently listed on the CISA KEV catalog and no public exploits are available, though the vulnerability is straightforward to trigger from any SSL/TLS client connection.

What versions of Apache are affected by CVE-2024-47252?

Apache HTTP Server versions 2.4.0 through 2.4.63 are vulnerable; version 2.4.64 and later contain the fix.

How do I check if my server is vulnerable to CVE-2024-47252?

Run 'apache2ctl -v' and verify the version is 2.4.63 or earlier, then check if mod_ssl is loaded with 'apache2ctl -M | grep ssl_module', and finally search your Apache configs with 'grep -r "CustomLog.*%{.*}[xc]" /etc/apache2/' to see if unescaped SSL variables are being logged.

Does Defensia detect CVE-2024-47252?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Apache is installed on a monitored server, CVE-2024-47252 will appear in your dashboard with remediation steps.

Related Apache CVEs

CVE-2021-41773CVSS 10A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
CVE-2021-42013CVSS 10It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
CVE-2021-44790CVSS 10A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.
CVE-2026-29167CVSS 10Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
CVE-2026-44631CVSS 10Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-47252. Free for 1 server.

Get started free