Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-23048

In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.

Published

2025-07-10T17:15:46.553

Last Modified

2025-11-04T22:16:06.920

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.1 (CRITICAL)

Weaknesses
  • Type: Secondary
    CWE-284
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache http_server < 2.4.64 Yes
References