CVE-2025-53020 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 86%

Affected Products (NVD)

Vendor	Product	Version
apache	http_server	2.4.17 ≤ 𝑥 < 2.4.64

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

apache2

bookworm	2.4.67-1~deb12u2 fixed
bookworm (security)	2.4.67-1~deb12u2 fixed
bullseye	vulnerable
bullseye (security)	2.4.67-1~deb11u1 fixed
forky	2.4.67-1 fixed
sid	2.4.67-1 fixed
trixie	2.4.67-1~deb13u2 fixed
trixie (security)	2.4.67-1~deb13u2 fixed

openSUSE / SLES Releases

openSUSE Product

Release

apache2

suse enterprise desktop 15 SP6	2.4.58-150600.5.35.1 fixed
suse enterprise desktop 15 SP7	2.4.62-150700.4.3.1 fixed
suse enterprise sap 15 SP4	2.4.51-150400.6.46.1 fixed
suse enterprise sap 15 SP5	2.4.51-150400.6.46.1 fixed
suse enterprise sap 15 SP6	2.4.58-150600.5.35.1 fixed
suse enterprise sap 15 SP7	2.4.62-150700.4.3.1 fixed
suse enterprise server 12 SP3	2.4.51-29.128.1 fixed
suse enterprise server 12 SP5	2.4.51-35.69.1 fixed
suse enterprise server 15 SP2	2.4.51-150200.3.82.1 fixed
suse enterprise server 15 SP3	2.4.51-150200.3.82.1 fixed
suse enterprise server 15 SP4	2.4.51-150400.6.46.1 fixed
suse enterprise server 15 SP5	2.4.51-150400.6.46.1 fixed
suse enterprise server 15 SP6	2.4.58-150600.5.35.1 fixed
suse enterprise server 15 SP7	2.4.62-150700.4.3.1 fixed

apache2-devel

suse enterprise sap 15 SP4	2.4.51-150400.6.46.1 fixed
suse enterprise sap 15 SP5	2.4.51-150400.6.46.1 fixed
suse enterprise sap 15 SP6	2.4.58-150600.5.35.1 fixed
suse enterprise sap 15 SP7	2.4.62-150700.4.3.1 fixed
suse enterprise server 12 SP5	2.4.51-35.69.1 fixed
suse enterprise server 15 SP2	2.4.51-150200.3.82.1 fixed
suse enterprise server 15 SP3	2.4.51-150200.3.82.1 fixed
suse enterprise server 15 SP4	2.4.51-150400.6.46.1 fixed
suse enterprise server 15 SP5	2.4.51-150400.6.46.1 fixed
suse enterprise server 15 SP6	2.4.58-150600.5.35.1 fixed
suse enterprise server 15 SP7	2.4.62-150700.4.3.1 fixed

apache2-doc

suse enterprise sap 15 SP4	2.4.51-150400.6.46.1 fixed
suse enterprise sap 15 SP5	2.4.51-150400.6.46.1 fixed
suse enterprise sap 15 SP6	2.4.51-150400.6.46.1 fixed
suse enterprise sap 15 SP7	2.4.51-150400.6.46.1 fixed
suse enterprise server 12 SP3	2.4.51-29.128.1 fixed
suse enterprise server 12 SP5	2.4.51-35.69.1 fixed
suse enterprise server 15 SP2	2.4.51-150200.3.82.1 fixed
suse enterprise server 15 SP3	2.4.51-150200.3.82.1 fixed
suse enterprise server 15 SP4	2.4.51-150400.6.46.1 fixed
suse enterprise server 15 SP5	2.4.51-150400.6.46.1 fixed
suse enterprise server 15 SP6	2.4.51-150400.6.46.1 fixed
suse enterprise server 15 SP7	2.4.51-150400.6.46.1 fixed

apache2-example-pages

suse enterprise server 12 SP3	2.4.51-29.128.1 fixed
suse enterprise server 12 SP5	2.4.51-35.69.1 fixed

apache2-prefork

suse enterprise desktop 15 SP6	2.4.58-150600.5.35.1 fixed
suse enterprise desktop 15 SP7	2.4.62-150700.4.3.1 fixed
suse enterprise sap 15 SP4	2.4.51-150400.6.46.1 fixed
suse enterprise sap 15 SP5	2.4.51-150400.6.46.1 fixed
suse enterprise sap 15 SP6	2.4.58-150600.5.35.1 fixed
suse enterprise sap 15 SP7	2.4.62-150700.4.3.1 fixed
suse enterprise server 12 SP3	2.4.51-29.128.1 fixed
suse enterprise server 12 SP5	2.4.51-35.69.1 fixed
suse enterprise server 15 SP2	2.4.51-150200.3.82.1 fixed
suse enterprise server 15 SP3	2.4.51-150200.3.82.1 fixed
suse enterprise server 15 SP4	2.4.51-150400.6.46.1 fixed
suse enterprise server 15 SP5	2.4.51-150400.6.46.1 fixed
suse enterprise server 15 SP6	2.4.58-150600.5.35.1 fixed
suse enterprise server 15 SP7	2.4.62-150700.4.3.1 fixed

apache2-tls13

suse enterprise server 12 SP5

2.4.51-35.69.1

fixed

apache2-tls13-devel

suse enterprise server 12 SP5

2.4.51-35.69.1

fixed

apache2-tls13-doc

suse enterprise server 12 SP5

2.4.51-35.69.1

fixed

apache2-tls13-example-pages

suse enterprise server 12 SP5

2.4.51-35.69.1

fixed

apache2-tls13-prefork

suse enterprise server 12 SP5

2.4.51-35.69.1

fixed

apache2-tls13-utils

suse enterprise server 12 SP5

2.4.51-35.69.1

fixed

apache2-tls13-worker

suse enterprise server 12 SP5

2.4.51-35.69.1

fixed

apache2-utils

suse enterprise sap 15 SP4	2.4.51-150400.6.46.1 fixed
suse enterprise sap 15 SP5	2.4.51-150400.6.46.1 fixed
suse enterprise sap 15 SP6	2.4.58-150600.5.35.1 fixed
suse enterprise sap 15 SP7	2.4.62-150700.4.3.1 fixed
suse enterprise server 12 SP3	2.4.51-29.128.1 fixed
suse enterprise server 12 SP5	2.4.51-35.69.1 fixed
suse enterprise server 15 SP2	2.4.51-150200.3.82.1 fixed
suse enterprise server 15 SP3	2.4.51-150200.3.82.1 fixed
suse enterprise server 15 SP4	2.4.51-150400.6.46.1 fixed
suse enterprise server 15 SP5	2.4.51-150400.6.46.1 fixed
suse enterprise server 15 SP6	2.4.58-150600.5.35.1 fixed
suse enterprise server 15 SP7	2.4.62-150700.4.3.1 fixed

apache2-worker

suse enterprise sap 15 SP4	2.4.51-150400.6.46.1 fixed
suse enterprise sap 15 SP5	2.4.51-150400.6.46.1 fixed
suse enterprise sap 15 SP6	2.4.58-150600.5.35.1 fixed
suse enterprise sap 15 SP7	2.4.62-150700.4.3.1 fixed
suse enterprise server 12 SP3	2.4.51-29.128.1 fixed
suse enterprise server 12 SP5	2.4.51-35.69.1 fixed
suse enterprise server 15 SP2	2.4.51-150200.3.82.1 fixed
suse enterprise server 15 SP3	2.4.51-150200.3.82.1 fixed
suse enterprise server 15 SP4	2.4.51-150400.6.46.1 fixed
suse enterprise server 15 SP5	2.4.51-150400.6.46.1 fixed
suse enterprise server 15 SP6	2.4.58-150600.5.35.1 fixed
suse enterprise server 15 SP7	2.4.62-150700.4.3.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

mod

RHEL 9

0:2.0.26-6.el9_8

fixed

Common Weakness Enumeration

CWE-401 - Missing Release of Memory after Effective Lifetime
The software does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

Vulnerability Media Exposure

[ENGLISH] New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare
Cybersecurity researchers have discovered a remote denial-of-service exploit that affects major web servers, including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. The vulnerability has been codenamed HTTP/2 Bomb by Calif. "The vulnerable behavior exists in each server's default HTTP/2 configuration," the company said, adding it was discovered by OpenAI Codex by chaining
Published: 2026-06-03T14:03:35+05:30

References

https://httpd.apache.org/security/vulnerabilities_24.html

http://www.openwall.com/lists/oss-security/2025/07/10/10

https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html