CVE-2025-65082

MEDIUM 6.5CVE-2025-65082 · Published 05/12/2025 · updated 25/09/2026

In short

CVE-2025-65082 is a MEDIUM (CVSS 6.5) vulnerability affecting http server (apache).
Chance of exploitation in the next 30 days (EPSS): 0.81%, higher than 56.9% of all vulnerabilities.
Fix: update to 2.4.66 or later.

Package	Affected versions	Patched versions
http server apache	`≥ 2.4.0, < 2.4.66`	`2.4.66`

Description

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs. This issue affects Apache HTTP Server from 2.4.0 through 2.4.65. Users are recommended to upgrade to version 2.4.66 which fixes the issue.

References

httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
openwall.com/lists/oss-security/2025/12/04/7 · Issue Tracking

More vulnerabilities in http server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

http server

apache

≥ 2.4.0, < 2.4.66

2.4.66

Description

More vulnerabilities in http server

See all →