CVE-2025-53020
Published: 10 July 2025
Summary
CVE-2025-53020 is a high-severity Missing Release of Memory after Effective Lifetime (CWE-401) vulnerability in Apache Http Server. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 10.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-53020 is a Late Release of Memory after Effective Lifetime vulnerability, assigned CWE-401, that affects Apache HTTP Server versions 2.4.17 through 2.4.63. The flaw carries a CVSS 3.1 base score of 7.5 and results in high availability impact without affecting confidentiality or integrity.
An unauthenticated remote attacker can send crafted requests over the network to trigger the memory-handling error, leading to resource exhaustion or service disruption on the affected server. No user interaction or credentials are required for exploitation.
Advisories from the Apache project and downstream distributions such as Debian recommend upgrading immediately to version 2.4.64, which resolves the issue; the Apache security page and oss-security mailing list provide the official patch and release notes.
The associated EPSS score remains flat at 0.0461 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21015
Vulnerability details
Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes the issue.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.