A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LApache HTTP Server
APPApache2.4.64
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
Related vulnerabilities
CVE-2024-38475CRITICAL9.1⚠ KEVPL ✓same product
Apache HTTP Server mod_rewrite — ujawnienie kodu i RCE poprzez błędne escapowanie
CVE-2021-42013CRITICAL9.8⚠ KEVPL ✓same product
Apache HTTP Server 2.4.50 — path traversal i RCE (niewystarczający patch CVE-2021-41773)
CVE-2021-41773CRITICAL9.8⚠ KEVPL ✓same product
Apache HTTP Server 2.4.49 — path traversal i RCE (aktywnie exploitowany)
CVE-2021-40438CRITICAL9.0⚠ KEVPL ✓same product
SSRF w mod_proxy Apache HTTP Server — przekierowanie żądań przez atakującego
CVE-2026-29167CRITICAL9.8PL ✓same product
Use-after-free w Apache HTTP Server z mod_ldap (CVE-2026-29167)