CVE-2025-49630

An assertion failure flaw was found in Apache httpd. Untrusted clients can send inputs that trigger an assertion failure in the mod_proxy_http2 module, which likely results in an Apache HTTP server crash or denial of service (DoS).

The vulnerability only affects Appache httpd if a reverse proxy is configured for an HTTP/2 backend, with the ProxyPreserveHost set to "on".

This vulnerability is rated as Moderate because it requires a highly specific and non-default configuration to be exploitable—namely, an Apache HTTP Server acting as a reverse proxy with an HTTP/2 backend and ProxyPreserveHost set to "on". The flaw results in an assertion failure in the mod_proxy_http2 module when handling specially crafted inputs from untrusted clients. While this can lead to a denial of service via server crash, the impact is limited to availability, with no risk of remote code execution or data leakage. Additionally, the condition is recoverable through a simple restart, and there is no persistent state corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.