CVE-2023-25690: Apache HTTP Server mod_proxy request smuggling via RewriteRule substitution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction, and a very high EPSS score make this a top remediation priority despite no KEV listing.

What it is

Apache HTTP Server 2.4.0 through 2.4.55 with mod_proxy enabled and certain RewriteRule or ProxyPassMatch configurations can be tricked into re-inserting user-controlled request-target data into a proxied request, enabling HTTP request smuggling. This matters because smuggling can bypass proxy access controls, route unintended URLs to origin servers, and poison caches.

Impact

An unauthenticated attacker can smuggle a second request through the proxy, bypassing access controls and reaching backend origin servers with attacker-chosen URLs. This can also poison shared caches, affecting other users.

Attack surface

Reachable over the network via crafted HTTP requests to a vulnerable proxy configuration; no authentication or user interaction is required per the CVSS vector. Only deployments using mod_proxy with the described RewriteRule or ProxyPassMatch variable-substitution patterns are affected.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high at 0.845 (99.7th percentile), indicating strong likelihood of exploitation activity. A public Packet Storm advisory exists, though no exploit tag is attached.

What to do

• Upgrade Apache HTTP Server to at least 2.4.56, which is the vendor-recommended fix.
• Audit mod_proxy configurations for RewriteRule or ProxyPassMatch rules that re-insert user-supplied request-target data via variable substitution, and rewrite them to avoid non-specific pattern capture.
• Where patching is delayed, disable mod_proxy or restrict the affected rewrite/proxy rules on internet-facing instances.
• Apply vendor and distribution advisories (Debian LTS, Gentoo GLSA) for packaged versions.

Detection

• Inspect proxy and origin access logs for requests containing encoded CRLF (%0d%0a) or unusual whitespace in the request-target that could indicate smuggling attempts.
• Compare proxy logs against backend origin logs for mismatched request counts, unexpected URLs, or requests that appear to originate from the proxy without a corresponding client request.
• Monitor for cache poisoning indicators such as unexpected cached responses or duplicate cache entries tied to proxied paths.
• Alert on anomalous request patterns to RewriteRule or ProxyPassMatch endpoints, including repeated malformed request-targets from a single source.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.