CVE-2025-23048 httpd: access control bypass by trusted clients is possible using TLS 1.3 session resumption

Impacted Products

CubeCOS 3.0.0

Introduction

This advisory covers both CVE-2025-49812 and CVE-2025-23048. 

CVE-2025-23048

In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.

CVE-2025-49812

In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.

Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.

Description

CVE-2025-23048

A vulnerability in Apache’s mod_ssl allows a trusted client to bypass access controls when virtual host access is restricted using client certificates. This configuration is rare in practice, and CubeCOS does not rely on client certificate–based access control. As a result, CubeCOS deployments are not impacted by this vulnerability.

CVE-2025-49812

This issue affects Apache servers configured with the SSLEngine optional configuration. In such cases, TLS upgrade handling may be insecure. CubeCOS configurations default to using the SSLEngine on and do not allow optional TLS upgrades. As a result, CubeCOS deployments are not impacted by this vulnerability.

Customer Actions Required

Customers are recommended to apply CubeCOS 3.0.0 Fix Pack 1, which includes security patches to maintain best security practices.

References

List

• https://nvd.nist.gov/vuln/detail/CVE-2025-23048
• https://httpd.apache.org/security/vulnerabilities_24.html
• https://access.redhat.com/security/cve/cve-2025-23048

Change Log

Contact

E-mail: security@bigstack.co