Homepage

Improper Access Control The advisory has been revoked - it doesn't affect any version of package httpd-core  (opens in a new tab)

Threat Intelligence

EPSS
1.04% (63rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALMALINUX10-HTTPDCORE-12485216
  • published4 Sept 2025
  • disclosed2 Sept 2025
Report a new vulnerability Found a mistake?

Introduced: 2 Sep 2025

CVE-2025-23048  (opens in a new tab)
CWE-284  (opens in a new tab)

Amendment

The AlmaLinux security team deemed this advisory irrelevant for AlmaLinux:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream httpd-core package and not the httpd-core package as distributed by AlmaLinux.

In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.

Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.