CVE-2025-53020

HIGH

Apache HTTP Server < 2.4.64 - Memory Leak

Title source: rule

Description

Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes the issue.

Exploits (1)

nomisec WORKING POC 1 stars

by galbarnahum · poc

https://github.com/galbarnahum/CVE-2025-53020-PoC

View Code ZIP pw:eip

References (3)

[Vendor Advisory] https://httpd.apache.org/security/vulnerabilities_24.html

[Mailing List] http://www.openwall.com/lists/oss-security/2025/07/10/10

[Mailing List] https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html

Scores

CVSS v3 7.5

EPSS 0.0126

EPSS Percentile 79.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-401

Status published

Products (1)

apache/http_server 2.4.17 - 2.4.64

Published Jul 10, 2025

Tracked Since Feb 18, 2026