Bug 2419139 (CVE-2025-65082) - CVE-2025-65082 httpd: Apache HTTP Server: CGI environment variable override
Summary: CVE-2025-65082 httpd: Apache HTTP Server: CGI environment variable override
Keywords:
Status: NEW
Alias: CVE-2025-65082
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2420214 2420215
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-12-05 11:01 UTC by OSIDB Bzimport
Modified: 2026-02-23 19:19 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2025:23732 0 None None None 2025-12-22 01:23:06 UTC
Red Hat Product Errata RHSA-2025:23919 0 None None None 2025-12-22 18:36:07 UTC
Red Hat Product Errata RHSA-2025:23932 0 None None None 2025-12-22 16:50:04 UTC
Red Hat Product Errata RHSA-2026:2994 0 None None None 2026-02-23 19:17:14 UTC
Red Hat Product Errata RHSA-2026:2995 0 None None None 2026-02-23 19:19:27 UTC

Description OSIDB Bzimport 2025-12-05 11:01:16 UTC 
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.

This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.

Users are recommended to upgrade to version 2.4.66 which fixes the issue.
Comment 2 errata-xmlrpc 2025-12-22 01:23:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:23732 https://access.redhat.com/errata/RHSA-2025:23732
Comment 3 errata-xmlrpc 2025-12-22 16:50:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:23932 https://access.redhat.com/errata/RHSA-2025:23932
Comment 4 errata-xmlrpc 2025-12-22 18:36:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:23919 https://access.redhat.com/errata/RHSA-2025:23919
Comment 5 tutorframe 2025-12-30 08:11:23 UTC 
The following items have addressed this issue:  https://access.redhat.com/errata/RHSA-2025:23919 https://soflowheelie-life.github.io
Comment 6 errata-xmlrpc 2026-02-23 19:17:12 UTC 
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 7
  JBoss Core Services for RHEL 8

Via RHSA-2026:2994 https://access.redhat.com/errata/RHSA-2026:2994
Comment 7 errata-xmlrpc 2026-02-23 19:19:25 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Core Services 2.4.62.SP3

Via RHSA-2026:2995 https://access.redhat.com/errata/RHSA-2026:2995
Note You need to log in before you can comment on or make changes to this bug.