CVE-2024-47252 Apache HTTP Server: mod_ssl error log variable escaping
An attacker can inject escape characters into Apache log files via SSL/TLS data when specific custom logging variables are configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47252?
CVE-2024-47252 is a high-severity vulnerability in Apache Http Server, published on 10 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.
In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.
Weakness: CWE-150
Which versions are affected by CVE-2024-47252?
1 open source package ship an affected version, including apache. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | From 2.4.0 | 2.4.64 |
Products include Apache Http Server.
How do I fix CVE-2024-47252?
Upgrade apache to 2.4.64 or later.
Is CVE-2024-47252 being exploited?
There is no known exploitation of CVE-2024-47252 in the wild and no public exploit code.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2024-47252, AZL-65172, AZL-65226, BELL-CVE-2024-47252, BIT-apache-2024-47252, CLSA-2025-1756830276 and 4 more.