{"id":"CVE-2025-65082","state":"PUBLISHED","title":"Apache HTTP Server: CGI environment variable override","description":"Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.\n\nThis issue affects Apache HTTP Server from 2.4.0 through 2.4.65.\n\nUsers are recommended to upgrade to version 2.4.66 which fixes the issue.","publishedAt":"2025-12-05T10:46:27.138Z","updatedAt":"2025-12-05T19:30:08.216Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","source":"CISA-ADP"},"assigner":"apache","products":["Apache Software Foundation Apache HTTP Server"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache HTTP Server","defaultStatus":"unaffected","versions":[{"version":"2.4.0","status":"affected","lessThanOrEqual":"2.4.65","versionType":"semver"}]}],"references":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2025/12/04/7"],"weaknesses":["CWE-150"],"ingestedAt":"2026-10-29T20:09:56.034Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/65xxx/CVE-2025-65082.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-65082","state":"PUBLISHED","datePublished":"2025-12-05T10:46:27.138Z","dateUpdated":"2025-12-05T19:30:08.216Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2025-11-17T14:06:38.215Z"},"containers":{"cna":{"title":"Apache HTTP Server: CGI environment variable override","descriptions":[{"lang":"en","value":"Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.\n\nThis issue affects Apache HTTP Server from 2.4.0 through 2.4.65.\n\nUsers are recommended to upgrade to version 2.4.66 which fixes the issue."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache HTTP Server","defaultStatus":"unaffected","versions":[{"version":"2.4.0","status":"affected","lessThanOrEqual":"2.4.65","versionType":"semver"}]}],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["vendor-advisory"]}],"metrics":[{"other":{"content":{"text":"low"},"type":"Textual description of severity"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-150","description":"CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2025-12-05T10:46:27.138Z"},"credits":[{"lang":"en","type":"finder","value":"Mattias Åsander (Umeå University)"}],"source":{"discovery":"UNKNOWN"},"timeline":[{"lang":"en","time":"2025-11-14T12:00:00.000Z","value":"reported"},{"lang":"en","time":"2025-12-01T12:00:00.000Z","value":"fixed in 2.4.x by r1930167"}],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2025/12/04/7"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-12-05T11:06:01.853Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-12-05T19:29:40.311810Z","id":"CVE-2025-65082","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-05T19:30:08.216Z"}}]}}}