CVE-2025-53020

HIGH 7.5CVE-2025-53020 · Published 10/07/2025 · updated 17/06/2026

In short

CVE-2025-53020 is a HIGH (CVSS 7.5) vulnerability affecting http server (apache).
Chance of exploitation in the next 30 days (EPSS): 5.0%, higher than 92.2% of all vulnerabilities.
Fix: update to 2.4.64 or later.

Package	Affected versions	Patched versions
http server apache	`≥ 2.4.17, < 2.4.64`	`2.4.64`

Description

Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes the issue.

References

httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
openwall.com/lists/oss-security/2025/07/10/10
lists.debian.org/debian-lts-announce/2025/08/msg00009.html

More vulnerabilities in http server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

http server

apache

≥ 2.4.17, < 2.4.64

2.4.64

More vulnerabilities in http server

See all →