medium CVSS 6.5 EPSS 0.16%

CVE-2025-65082·Apache vulnerability

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs. This issue affects Apache HTTP Server from 2.4.0 through 2.4.65. Users are recommended to upgrade to version 2.4.66 which fixes the issue.

Severity
medium
Software
Apache
Fixed in
2.4.66
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.16% — higher than 36% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

From: 2.4.0

Until: 2.4.66

Fixed in: 2.4.66

How to fix this CVE

Apache HTTP Server versions 2.4.0 through 2.4.65 contain a vulnerability where configuration-defined environment variables can override server-calculated variables passed to CGI programs, potentially leading to information disclosure or request manipulation. Upgrade to Apache 2.4.66 or later to resolve this issue. Review your CGI applications and environment variable configurations after patching to ensure no unintended behavior changes.

sudo dnf update httpd httpd-tools

Defensia detects this vulnerability

How to check if you are affected

  1. Check installed Apache version with: apache2ctl -v (or httpd -v on RHEL/CentOS/Amazon Linux)
  2. Verify CGI is enabled by checking for mod_cgi or mod_cgid in: apache2ctl -M | grep cgi (or httpd -M on RHEL/CentOS)
  3. Search Apache access and error logs for CGI requests with suspicious environment variable patterns: grep -E 'CGI|REMOTE_|SERVER_' /var/log/apache2/error.log
  4. After upgrading, confirm version with apache2ctl -v and restart Apache: sudo systemctl restart apache2 (or httpd on RHEL/CentOS)

FAQ

What is CVE-2025-65082?

This vulnerability allows Apache configuration directives to set environment variables that improperly override internally calculated variables before they reach CGI programs. This can lead to CGI scripts receiving modified or spoofed environment values, potentially bypassing security controls or leaking sensitive information.

Is CVE-2025-65082 being actively exploited?

No, this vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are available. However, timely patching remains critical for environments running CGI applications.

What versions of Apache are affected by CVE-2025-65082?

Apache HTTP Server versions 2.4.0 through 2.4.65 are vulnerable. Version 2.4.66 and later contain the fix.

How do I check if my server is vulnerable to CVE-2025-65082?

Run apache2ctl -v (or httpd -v) and check if the version is between 2.4.0 and 2.4.65. If yes, and you have CGI enabled (verify with apache2ctl -M | grep cgi), your server is vulnerable.

Does Defensia detect CVE-2025-65082?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Apache is installed on a monitored server, CVE-2025-65082 will appear in your dashboard with remediation steps.

Related Apache CVEs

CVE-2021-44790CVSS 10A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.
CVE-2021-41773CVSS 10A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
CVE-2021-42013CVSS 10It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
CVE-2026-57941CVSS 9.8Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
CVE-2026-56154CVSS 9.8Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2025-65082. Free for 1 server.

Get started free