CVE-2025-49630: Apache HTTP Server DOS Vulnerability

CVE-2025-49630 Overview

CVE-2025-49630 is a denial of service vulnerability affecting Apache HTTP Server versions 2.4.26 through 2.4.63. The vulnerability exists in the mod_proxy_http2 module and can be triggered by untrusted clients when specific proxy configurations are in use. When exploited, the vulnerability causes an assertion failure that crashes the server, resulting in service disruption.

The vulnerability specifically affects configurations where a reverse proxy is configured for an HTTP/2 backend with the ProxyPreserveHost directive set to "on". This configuration preserves the original Host header when proxying requests, and under certain conditions, malicious clients can trigger an assertion that terminates the server process.

Critical Impact

Untrusted clients can crash Apache HTTP Server instances configured as HTTP/2 reverse proxies, causing complete service disruption and potential cascading failures in dependent applications.

Affected Products

• Apache HTTP Server versions 2.4.26 through 2.4.63
• Systems using mod_proxy_http2 module
• Reverse proxy configurations with ProxyPreserveHost on for HTTP/2 backends

Discovery Timeline

• 2025-07-10 - CVE-2025-49630 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2025-49630

Vulnerability Analysis

This vulnerability is classified under CWE-617 (Reachable Assertion), which occurs when the application contains an assertion that can be triggered by an attacker. In the context of mod_proxy_http2, the assertion is reachable through specific network conditions when processing HTTP/2 proxy requests.

The vulnerability is exploitable over the network without requiring authentication or user interaction. When triggered, the assertion causes the Apache worker process to terminate abnormally, resulting in denial of service. In prefork or worker MPM configurations, this may only affect a single child process, but repeated attacks can exhaust available workers or crash the parent process depending on the configuration.

Root Cause

The root cause lies in the mod_proxy_http2 module's handling of requests when ProxyPreserveHost is enabled. When proxying to an HTTP/2 backend, certain request characteristics trigger an internal assertion check that was not designed to handle maliciously crafted input from untrusted clients.

Assertions are typically used during development to catch programming errors, but when reachable by external input in production environments, they become security vulnerabilities. In this case, the assertion in mod_proxy_http2 fails to account for edge cases in HTTP/2 proxy request processing, allowing remote attackers to trigger a crash condition.

Attack Vector

The attack is network-based and can be executed by any untrusted client that can reach the vulnerable Apache HTTP Server instance. The attacker does not require any authentication or special privileges.

The attack scenario involves:

1. An Apache HTTP Server configured as a reverse proxy for an HTTP/2 backend
2. The ProxyPreserveHost on directive enabled in the configuration
3. An attacker sending specially crafted requests that trigger the assertion in mod_proxy_http2

The vulnerability is accessible without user interaction, making it suitable for automated exploitation. While the impact is limited to availability (denial of service), the ease of exploitation makes this a significant concern for publicly accessible Apache instances.

Detection Methods for CVE-2025-49630

Indicators of Compromise

• Unexpected Apache HTTP Server process crashes or restarts
• Error logs showing assertion failures in mod_proxy_http2
• Increased frequency of child process terminations
• Service availability issues affecting HTTP/2 proxied backends

Detection Strategies

• Monitor Apache error logs for assertion failure messages related to mod_proxy_http2
• Configure process monitoring to alert on unexpected Apache worker terminations
• Implement health checks to detect service availability degradation
• Review access logs for unusual request patterns targeting proxied HTTP/2 endpoints

Monitoring Recommendations

• Enable detailed logging for mod_proxy_http2 module operations
• Set up automated alerting for Apache service restarts and crashes
• Monitor system logs for SIGABRT signals from Apache processes
• Track worker process lifecycle metrics to identify abnormal termination patterns

How to Mitigate CVE-2025-49630

Immediate Actions Required

• Upgrade Apache HTTP Server to a patched version beyond 2.4.63
• If upgrade is not immediately possible, consider disabling mod_proxy_http2 temporarily
• Review and audit configurations using ProxyPreserveHost on with HTTP/2 backends
• Implement rate limiting and request filtering at the edge

Patch Information

Apache has released security updates to address this vulnerability. The official security advisory is available at the Apache HTTP Server Vulnerabilities page. Organizations should upgrade to the latest available version that includes the fix for CVE-2025-49630.

Additional security information has been shared through the OpenWall OSS Security mailing list and subsequent updates. Debian users should refer to the Debian LTS Security Announcement for distribution-specific guidance.

Workarounds

• Disable ProxyPreserveHost directive if not strictly required for HTTP/2 backends
• Switch to HTTP/1.1 for backend connections by using mod_proxy_http instead of mod_proxy_http2
• Implement a Web Application Firewall (WAF) to filter potentially malicious requests
• Use frontend load balancers to add an additional layer of protection before Apache

# Configuration example - Disable ProxyPreserveHost as a temporary workaround
# In your Apache configuration file (httpd.conf or virtual host config):

# Change this:
# ProxyPreserveHost on

# To this:
ProxyPreserveHost off

# Or disable mod_proxy_http2 entirely and use HTTP/1.1:
# a2dismod proxy_http2
# a2enmod proxy_http

# Restart Apache to apply changes:
# systemctl restart apache2