CVE-2025-23048 Apache HTTP Server: mod_ssl access control bypass with session resumption

🗓️ 10 Jul 2025 16:56:53Reported by apacheType

Access control bypass in Apache HTTP Server mod_ssl due to TLS 1.3 session resumption issue.

Reporter	Title	Published	Views	Family All 236
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	22 Dec 202509:22	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in httpd library (CVE-2024-47252, CVE-2025-23048, CVE-2025-49630) affect Power HMC.	20 Nov 202506:09	–	ibm
IBM Security Bulletins	Security Bulletin: TSSC/IMC addresses multiple security vulnerabilities.	14 Nov 202510:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System	30 Jan 202617:00	–	ibm
FreeBSD	Apache httpd -- Multiple vulnerabilities	10 Jul 202500:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2025-1125)	4 Aug 202500:00	–	nessus
Tenable Nessus	Amazon Linux 2 : httpd (ALAS-2025-2958)	4 Aug 202500:00	–	nessus
Tenable Nessus	AlmaLinux 9 : httpd (ALSA-2025:15023)	29 Sep 202500:00	–	nessus
Tenable Nessus	AlmaLinux 10 : httpd (ALSA-2025:15095)	9 Oct 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : httpd:2.4 (ALSA-2025:15123)	4 Sep 202500:00	–	nessus

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache HTTP Server",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.4.63",
        "status": "affected",
        "version": "2.4.35",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
httpd	www.httpd.apache.org/security/vulnerabilities_24.html

10 Jul 2025 16:56Current

EPSS0.00058

CWE-284