CVE-2025-54090
Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64
Summary
Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64
Original description
The description as published by the source.
A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true".
Users are recommended to upgrade to version 2.4.65, which fixes the issue.
Affected packages
Bitnami
apache
[{"type":"SEMVER","events":[{"introduced":"2.4.64"},{"fixed":"2.4.65"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2025-54090 apache2 Fixed in: 2.4.65-r0
- Debian DEBIAN-CVE-2025-54090 apache2 Fixed in: 2.4.65-1
References
- advisory httpd.apache.org
- advisory nvd.nist.gov
- advisory github.com
- web news.ycombinator.com
- web openwall.com
- web lists.debian.org