In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.
Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://httpd.apache.org/security/vulnerabilities_24.html | Vendor Advisory |
Configurations
History
29 Jul 2025, 15:14
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | |
| First Time |
Apache http Server
Apache |
|
| References | () https://httpd.apache.org/security/vulnerabilities_24.html - Vendor Advisory |
15 Jul 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
10 Jul 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-07-10 17:15
Updated : 2025-07-29 15:14
NVD link : CVE-2025-23048
Mitre link : CVE-2025-23048
JSON object : View
Products Affected
apache
- http_server
CWE
No CWE.