CVE-2025-49630

Deeper analysis

CVE-2025-49630 is a reachable assertion vulnerability (CWE-617) in Apache HTTP Server versions 2.4.26 through 2.4.63 that affects the mod_proxy_http2 module. It is triggered only in reverse-proxy configurations that use an HTTP/2 backend and have ProxyPreserveHost set to "on", allowing an unauthenticated remote client to cause the server process to abort.

An attacker with network access can send specially crafted requests to the affected proxy, resulting in a denial of service that impacts availability but does not allow code execution or data disclosure. The CVSS 3.1 score of 7.5 reflects the low attack complexity and lack of required privileges or user interaction.

Advisories published on the Apache HTTP Server security page and mirrored on oss-security and Debian LTS lists recommend upgrading to a fixed release or applying vendor patches; they also note that disabling ProxyPreserveHost or avoiding HTTP/2 backends mitigates the issue when an immediate update is not feasible.

The EPSS score rose from a low baseline to a recorded peak of 0.0467 before settling at the current value of 0.0267, indicating measurable post-disclosure interest in exploitation.