Improper Neutralization Vulnerability in Apache HTTP Server by Apache
CVE-2025-65082

6.5MEDIUM

Key Information:

Vendor: Apache
Status: Apache Http Server
Vendor: CVE Published:; 5 December 2025

What is CVE-2025-65082?

A vulnerability has been identified in the Apache HTTP Server that allows for the improper neutralization of control sequences through environment variables set in the server configuration. This issue arises when environment variables override those calculated by the server specifically for CGI programs. It is crucial for users to upgrade to version 2.4.66 or later to mitigate this vulnerability and ensure the security of their web applications.

Affected Version(s)

Apache HTTP Server 2.4.0 <= 2.4.65

References

https://httpd.apache.org/security/vulnerabilities_24.html

vendor-advisory

CVSS V3.1

Score:

6.5

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Dec 5, 2025
Vulnerability Reserved
Nov 17, 2025

Credit

Mattias Åsander (Umeå University)

CVE-2025-65082 Data

JSON