CVE-2025-55753 Apache HTTP Server: mod_md (ACME), unintended retry intervals
Integer overflow in Apache mod_md causes zero-delay certificate renewal retries, leading to excessive resource consumption and potential denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-55753?
CVE-2025-55753 is a high-severity vulnerability in Apache Http Server, published on 5 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds.
This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
Users are recommended to upgrade to version 2.4.66, which fixes the issue.
Weakness: CWE-190
Which versions are affected by CVE-2025-55753?
1 open source package ship an affected version, including apache. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | From 2.4.30 | 2.4.66 |
Linux distribution packages (25)
mod_md AlmaLinux:10 | All versions | 1:2.4.26-4.el10_1 |
mod_md AlmaLinux:9 | All versions | 1:2.4.26-1.el9_7.1 |
mod_md Red Hat:enterprise_linux:10.1 | All versions | 1:2.4.26-4.el10_1 |
mod_md-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 1:2.4.26-4.el10_1 |
mod_md-debugsource Red Hat:enterprise_linux:10.1 | All versions | 1:2.4.26-4.el10_1 |
mod_md Red Hat:enterprise_linux:9::appstream | All versions | 1:2.4.26-1.el9_7.1 |
mod_md-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:2.4.26-1.el9_7.1 |
mod_md-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 1:2.4.26-1.el9_7.1 |
mod_md Red Hat:enterprise_linux_eus:10.0 | All versions | 1:2.4.26-3.el10_0.1 |
mod_md-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 1:2.4.26-3.el10_0.1 |
mod_md-debugsource Red Hat:enterprise_linux_eus:10.0 | All versions | 1:2.4.26-3.el10_0.1 |
mod_md Red Hat:rhel_e4s:9.0::appstream | All versions | 1:2.4.0-3.el9_0.1 |
mod_md-debuginfo Red Hat:rhel_e4s:9.0::appstream | All versions | 1:2.4.0-3.el9_0.1 |
mod_md-debugsource Red Hat:rhel_e4s:9.0::appstream | All versions | 1:2.4.0-3.el9_0.1 |
mod_md Red Hat:rhel_e4s:9.2::appstream | All versions | 1:2.4.19-1.el9_2.1 |
mod_md-debuginfo Red Hat:rhel_e4s:9.2::appstream | All versions | 1:2.4.19-1.el9_2.1 |
mod_md-debugsource Red Hat:rhel_e4s:9.2::appstream | All versions | 1:2.4.19-1.el9_2.1 |
mod_md Red Hat:rhel_eus:9.4::appstream | All versions | 1:2.4.19-1.el9_4.1 |
mod_md-debuginfo Red Hat:rhel_eus:9.4::appstream | All versions | 1:2.4.19-1.el9_4.1 |
mod_md-debugsource Red Hat:rhel_eus:9.4::appstream | All versions | 1:2.4.19-1.el9_4.1 |
mod_md Red Hat:rhel_eus:9.6::appstream | All versions | 1:2.4.26-1.el9_6.1 |
mod_md-debuginfo Red Hat:rhel_eus:9.6::appstream | All versions | 1:2.4.26-1.el9_6.1 |
mod_md-debugsource Red Hat:rhel_eus:9.6::appstream | All versions | 1:2.4.26-1.el9_6.1 |
mod_md Rocky Linux:10 | All versions | 1:2.4.26-4.el10_1 |
mod_md Rocky Linux:9 | All versions | 1:2.4.26-1.el9_7.1 |
Products include Apache Http Server.
How do I fix CVE-2025-55753?
Upgrade apache to 2.4.66 or later.
Is CVE-2025-55753 being exploited?
There is no known exploitation of CVE-2025-55753 in the wild and no public exploit code.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2025-55753, ALSA-2025:23738, ALSA-2025:23739, AZL-71851, AZL-71858, AZL-71863 and 20 more.