CVE-2025-23048

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.4.35 through 2.4.63

Description: In certain mod ssl configurations, an access control bypass is possible for trusted clients using TLS 1.3 session resumption. This occurs when mod ssl is configured for multiple virtual hosts, each restricted to a different set of trusted client certificates, and SSLStrictSNIVHostCheck is not enabled in either virtual host.

Recommendations: Apache HTTP Server versions 2.4.35 through 2.4.63: Enable SSLStrictSNIVHostCheck in all virtual host configurations.