CVE-2025-55753
published 2025-12-05CVE-2025-55753: An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.42%
34.2th percentile
An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds.
This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
Users are recommended to upgrade to version 2.4.66, which fixes the issue.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 2.4.30 < 2.4.66 | 2.4.66 |
| apache_software_foundation | apache_http_server | >= 2.4.30 < 2.4.66 | 2.4.66 |
| debian | apache2 | < apache2 2.4.66-1~deb12u1 (bookworm) | apache2 2.4.66-1~deb12u1 (bookworm) |
| msrc | azl3_httpd_2.4.65-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_httpd_2.4.65-1_on_cbl_mariner_2.0 | — | — |
| ubuntu | apache2 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Apache HTTP Server regression
vendor_ubuntu·2026-05-29·CVSS 7.3
CVE-2023-38709 [HIGH] Apache HTTP Server regression
Title: Apache HTTP Server regression
Summary: USN-8338-1 introduced a regression in Apache HTTP Server
USN-8338-1 fixed vulnerabilities in Apache HTTP Server. The update
introduced a regression that prevented mod_http2 from loading on Ubuntu
18.04 LTS. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Apache HTTP Server incorrectly handled certain
response headers. An attacker could possibly use this issue to perform
HTTP response splitting attacks. This issue only affected Ubuntu 14.04
LTS. (CVE-2023-38709)
Will Dormann and David Warren discovered that Apache HTTP Server's HTTP/2
implementation did not properly reclaim memory when streams were reset by
clients. A remote attacker could possibly use this issue to cause
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2026-05-28·CVSS 7.3
CVE-2023-38709 [HIGH] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
It was discovered that Apache HTTP Server incorrectly handled certain
response headers. An attacker could possibly use this issue to perform
HTTP response splitting attacks. This issue only affected Ubuntu 14.04
LTS. (CVE-2023-38709)
Will Dormann and David Warren discovered that Apache HTTP Server's HTTP/2
implementation did not properly reclaim memory when streams were reset by
clients. A remote attacker could possibly use this issue to cause Apache
HTTP Server to consume resources, leading to a denial of service. This
issue only affected Ubuntu 18.04 LTS. (CVE-2023-45802)
Keran Mu and Jianjun Chen discovered that Apache HTTP Server incorrectly
handled certain response headers.
Ubuntu
Apache HTTP Server regression
vendor_ubuntu·2026-03-09·CVSS 7.5
[HIGH] Apache HTTP Server regression
Title: Apache HTTP Server regression
Summary: USN-7968-1 introduced a regression in Apache HTTP Server
USN-7968-1 fixed vulnerabilities in Apache HTTP Server. The update
introduced a regression in mod_md where the MDStapleOthers setting was
ignored which resulted in OCSP being broken for some domains. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Apache HTTP Server incorrectly handled failed
ACME certificate renewals. This could result in renewal attempts to be
repeated without delays, possibly leading to a denial of service.
(CVE-2025-55753)
Anthony Parfenov discovered that the Apache HTTP Server would pass the
query string to cmd directives when configured with Server Side Includes
(SSI) enabled and mod_cgid
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2026-01-19·CVSS 7.5
CVE-2025-65082 [HIGH] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
It was discovered that the Apache HTTP Server incorrectly handled failed
ACME certificate renewals. This could result in renewal attempts to be
repeated without delays, possibly leading to a denial of service.
(CVE-2025-55753)
Anthony Parfenov discovered that the Apache HTTP Server would pass the
query string to cmd directives when configured with Server Side Includes
(SSI) enabled and mod_cgid. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2025-58098)
Mattias Åsander discovered that the Apache HTTP Server incorrectly
neutralized certain environment variables. This could result in
unexpectedly superseding variables calculated by the server for CGI
pro
Microsoft
Apache HTTP Server: mod_md (ACME), unintended retry intervals
vendor_msrc·2025-12-09·CVSS 7.5
CVE-2025-55753 [HIGH] CWE-190 Apache HTTP Server: mod_md (ACME), unintended retry intervals
Apache HTTP Server: mod_md (ACME), unintended retry intervals
Mariner: Mariner
apache: apache
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Red Hat
mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals
vendor_redhat·2025-12-05·CVSS 7.5
CVE-2025-55753 [HIGH] CWE-190 mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals
mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals
An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds.
This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
Users are recommended to upgrade to version 2.4.66, which fixes the issue.
An integer overflow flaw has been discovered in the Apache HTTP server. The integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds
Debian
CVE-2025-55753: apache2 - An integer overflow in the case of failed ACME certificate renewal leads, after ...
vendor_debian·2025·CVSS 7.5
CVE-2025-55753 [HIGH] CVE-2025-55753: apache2 - An integer overflow in the case of failed ACME certificate renewal leads, after ...
An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds. This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.
Scope: local
bookworm: resolved (fixed in 2.4.66-1~deb12u1)
bullseye: resolved (fixed in 2.4.66-1~deb11u1)
forky: resolved (fixed in 2.4.66-1)
sid: resolved (fixed in 2.4.66-1)
trixie: resolved (fixed in 2.4.66-1~deb13u1)
OSV
apache2 regression
osv·2026-03-09·CVSS 7.5
[HIGH] apache2 regression
apache2 regression
USN-7968-1 fixed vulnerabilities in Apache HTTP Server. The update
introduced a regression in mod_md where the MDStapleOthers setting was
ignored which resulted in OCSP being broken for some domains. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Apache HTTP Server incorrectly handled failed
ACME certificate renewals. This could result in renewal attempts to be
repeated without delays, possibly leading to a denial of service.
(CVE-2025-55753)
Anthony Parfenov discovered that the Apache HTTP Server would pass the
query string to cmd directives when configured with Server Side Includes
(SSI) enabled and mod_cgid. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2025-5809
OSV
apache2 vulnerabilities
osv·2026-01-19·CVSS 7.5
CVE-2025-55753 [HIGH] apache2 vulnerabilities
apache2 vulnerabilities
It was discovered that the Apache HTTP Server incorrectly handled failed
ACME certificate renewals. This could result in renewal attempts to be
repeated without delays, possibly leading to a denial of service.
(CVE-2025-55753)
Anthony Parfenov discovered that the Apache HTTP Server would pass the
query string to cmd directives when configured with Server Side Includes
(SSI) enabled and mod_cgid. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2025-58098)
Mattias Åsander discovered that the Apache HTTP Server incorrectly
neutralized certain environment variables. This could result in
unexpectedly superseding variables calculated by the server for CGI
programs. (CVE-2025-65082)
Mattias Åsander discovered that the Apache HTTP Server incorr
OSV
CVE-2025-55753: An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the back
osv·2025-12-05·CVSS 7.5
CVE-2025-55753 [HIGH] CVE-2025-55753: An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the back
An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds.
This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
Users are recommended to upgrade to version 2.4.66, which fixes the issue.
GHSA
GHSA-3j5h-f552-7rhh: An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the back
ghsa_unreviewed·2025-12-05
CVE-2025-55753 [HIGH] CWE-190 GHSA-3j5h-f552-7rhh: An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the back
An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds.
This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
Users are recommended to upgrade to version 2.4.66, which fixes the issue.
OSV
CVE-2025-55753: An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the back
osv·2025-12-05·CVSS 7.5
CVE-2025-55753 [HIGH] CVE-2025-55753: An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the back
An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds. This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.
No detection rules found.
No public exploits indexed.
2025-12-05
Published