- Description
- In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.
- Source
- security@apache.org
- NVD status
- Modified
- Products
- http_server
CVSS 3.1
- Type
- Secondary
- Base score
- 9.1
- Impact score
- 5.2
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Severity
- CRITICAL
- security@apache.org
- CWE-284
- Hype score
- Not currently trending
CVE-2023-38545 9.8 Critical CVE-2025-23048 9.1 Critical CVE-2025-55754 9.6 Critical HP Device Manager Vulnerability Update (5.0.16) | HP® Support https://t.co/8FGdyDPQtJ
@autumn_good_35
10 Mar 2026
495 Impressions
1 Retweet
1 Like
0 Bookmarks
0 Replies
0 Quotes
⚠️ Vulnerabilidades en productos Juniper Networks ❗ CVE-2025-32990 ❗ CVE-2025-32988 ❗ CVE-2025-23048 ➡️ Más info: https://t.co/L2IfbfV9Gr https://t.co/PWDTxfgcCA
@CERTpy
18 Feb 2026
156 Impressions
1 Retweet
3 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9F21E49A-F8C0-4FEB-BC09-4F4D9F6C5BA0",
"versionEndExcluding": "2.4.64",
"versionStartIncluding": "2.4.35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]