{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/apache-http-server-2.4.35-2.4.62/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2025-23048"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Apache HTTP Server (2.4.35-2.4.62)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache HTTP Server versions 2.4.35 through 2.4.62 are vulnerable to a client certificate authentication bypass (CVE-2025-23048) when TLS 1.3 session resumption is enabled. The vulnerability occurs because the server may incorrectly reuse a session established on one virtual host (vhost1) for a different virtual host (vhost2) that requires a distinct client CA certificate. This allows an attacker possessing a valid certificate for vhost1 to access protected resources on vhost2 without providing a certificate trusted by vhost2.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies two virtual hosts on a target Apache server configured with differing \u003ccode\u003eSSLCACertificateFile\u003c/code\u003e directives.\u003c/li\u003e\n\u003cli\u003eAttacker performs a full TLS 1.3 handshake with the first virtual host using a valid client certificate trusted by that specific host.\u003c/li\u003e\n\u003cli\u003eThe Apache server accepts the handshake and issues a session ticket.\u003c/li\u003e\n\u003cli\u003eAttacker captures the session ticket or maintains the session state.\u003c/li\u003e\n\u003cli\u003eAttacker initiates a connection to the second virtual host (vhost2) requesting a restricted path.\u003c/li\u003e\n\u003cli\u003eAttacker uses the session ticket from vhost1 to resume the TLS session on vhost2.\u003c/li\u003e\n\u003cli\u003eApache incorrectly validates the resumed session, bypassing the client certificate check required for vhost2.\u003c/li\u003e\n\u003cli\u003eAttacker gains unauthorized access to protected resources on vhost2.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache HTTP Server to version 2.4.64 or later to address the vulnerability.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, set \u003ccode\u003eSSLStrictSNIVHostCheck on\u003c/code\u003e within the virtual host configuration for all TLS 1.3 enabled hosts that rely on distinct client certificate authorities. This setting prevents cross-SNI session resumption and mitigates the bypass.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-01T09:58:38Z","date_published":"2026-11-01T09:58:38Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2025-23048/","summary":"CVE-2025-23048 allows an attacker to bypass client certificate authentication in Apache HTTP Server versions 2.4.35 through 2.4.62 by resuming a TLS 1.3 session across virtual hosts with different CA configurations.","title":"Apache HTTP Server: TLS 1.3 Session Resumption Authentication Bypass (CVE-2025-23048)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2025-23048/"}],"language":"en","title":"CraftedSignal Threat Feed - Apache HTTP Server (2.4.35-2.4.62)","version":"https://jsonfeed.org/version/1.1"}