Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-65082

25
FAUCET Score

CVE-2025-65082 is a medium-severity vulnerability affecting Apache HTTP Server versions 2.4.0 through 2.4.65. It involves improper neutralization of escape sequences, allowing environment variables set in the Apache configuration to unexpectedly override server-calculated variables for CGI programs. The vulnerability has a CVSS score of 6.5, indicating low confidentiality and integrity impact, but no availability impact. There is currently no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or KEV listing, though it has garnered some community discussion and media coverage. Users are advised to upgrade to version 2.4.66 to remediate this issue.

Impacted Technologies

VendorProductVersion(s)CPE
>= 2.4.0, <= 2.4.65CPE match
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
>= 2.4.0, < 2.4.66CPE matchmatch criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

6.5MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
2.5
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.77%
Probability of exploitation in next 30 days
EPSS Percentile
51.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0077 is in the 32nd percentile among its peer group of 23,725 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (20)

apachepatch availablevia llm_extracted
Fixed in: 2.4
gcppatch availablevia llm_extracted
View patch
microsoftpatch availablevia msrc
Product: cbl2 httpd 2.4.65-1 on CBL Mariner 2.0Fixed in: 2.4.66-1
microsoftpatch availablevia msrc
Product: azl3 httpd 2.4.65-1 on Azure Linux 3.0Fixed in: 2.4.66-1
microsoftpatch availablevia msrc
Product: 19577-17086Fixed in: 2.4.66-1
microsoftpatch availablevia msrc
Product: 19625-17084Fixed in: 2.4.66-1
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-httpd-0:2.4.62-11.el8jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-httpd-0:2.4.62-11.el7jbcs
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: httpd-0:2.4.63-4.el10_1.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: httpd:2.4-8100020251212173309.489197e6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: httpd-0:2.4.62-7.el9_7.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Core Services 2.4.62.SP3Fixed in: jbcs-httpd24-httpd
View patch
ubuntupatch availablevia ubuntu_usn
Product: apache2 (trusty)Fixed in: 2.4.7-1ubuntu4.22+esm12
ubuntupatch availablevia ubuntu_usn
Product: apache2 (xenial)Fixed in: 2.4.18-2ubuntu3.17+esm17
ubuntupatch availablevia ubuntu_usn
Product: apache2 (focal)Fixed in: 2.4.41-4ubuntu3.23+esm3
ubuntupatch availablevia ubuntu_usn
Product: apache2 (bionic)Fixed in: 2.4.29-1ubuntu4.27+esm7
applevendor investigatingvia apple_support
View patch
redhatno patchvia redhat_api
Product: Red Hat JBoss Core ServicesFixed in: httpd
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: httpd
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: httpd

Vendor Advisories (10)

ubuntuUSN-8338-1

Apache HTTP Server vulnerabilities

May 28, 2026
gcpllm-gcp-e028ccdedcbc6cccCRITICAL

HP Device Manager Vulnerability Update (5.0.16)

Mar 9, 2026
apachellm-apache-f398f8ed28802aa3LOW

Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project

Mar 2, 2026
apachellm-apache-a7a91ec4c0e9421dHIGH

Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project

Dec 10, 2025
microsoft2025-Dec/CVE-2025-65082Moderate

Apache HTTP Server: CGI environment variable override

Dec 9, 2025
redhatCVE-2025-65082Moderate

httpd: Apache HTTP Server: CGI environment variable override

Dec 5, 2025
appleapple:126794LOW

About the security content of macOS Tahoe 26.4 - Apple Support

appleapple:126795LOW

About the security content of macOS Sequoia 15.7.5 - Apple Support

apachellm-apache-684e4d0003611bd4LOW

Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project

appleapple:126796LOW

About the security content of macOS Sonoma 14.8.5 - Apple Support

References

openwall.com / lists/oss-security/2025/12/04/7
Issue TrackingThird Party Advisory
httpd.apache.org / security/vulnerabilities_24.html
Vendor Advisory