BIT-apache-2025-54090

vendorUSosv

Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64

view advisory published 2025-07-29Licence: per source

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-54090US	—	0.88% (59th)	—	2025-07-23
A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue.

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2025/07/24/2WEB
https://httpd.apache.org/security/vulnerabilities_24.htmlARTICLE
https://lists.debian.org/debian-lts-announce/2025/08/msg00009.htmlWEB
https://news.ycombinator.com/item?id=44666896FIX
https://nvd.nist.gov/vuln/detail/CVE-2025-54090WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan