CVE-2025-55753

CWE-190 — Integer Overflow11 documents8 sources
Severity
7.5HIGH
EPSS
0.1%
top 71.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache Http ServerApache Http Server
Timeline
PublishedDec 5
Latest updateMar 9

Description

An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds. This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶NVDapache/http_server2.4.30 — 2.4.66
▶Alpineapache2< 2.4.66-r0+3
▶Debianapache2< 2.4.66-1~deb11u1+3
▶Ubuntuapache2< 2.4.52-1ubuntu4.18+2

🔴Vulnerability Details

6
OSV
apache2 regression↗2026-03-09
▶
OSV
apache2 vulnerabilities↗2026-01-19
▶
CVEList
Apache HTTP Server: mod_md (ACME), unintended retry intervals↗2025-12-05
▶
OSV
CVE-2025-55753: An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the back↗2025-12-05
▶
GHSA
GHSA-3j5h-f552-7rhh: An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the back↗2025-12-05
▶

📋Vendor Advisories

4
Ubuntu
Apache HTTP Server vulnerabilities↗2026-01-19
▶
Microsoft
Apache HTTP Server: mod_md (ACME), unintended retry intervals↗2025-12-09
▶
Red Hat
mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals↗2025-12-05
▶
Debian
CVE-2025-55753: apache2 - An integer overflow in the case of failed ACME certificate renewal leads, after ...↗2025
▶