Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2024-47252 Details

Description

Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: CISA-ADPCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html CVE
http://www.openwall.com/lists/oss-security/2025/07/10/2 CVE
http://www.openwall.com/lists/oss-security/2025/07/10/6 CVE
https://httpd.apache.org/security/vulnerabilities_24.html [email protected]Vendor Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-150Improper Neutralization of Escape, Meta, or Control Sequences[email protected]

Affected Products

ProductVersions
apache http server
>= 2.4.0, < 2.4.64

CPE

  • cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

7 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2024-47252
NVD Published Date:
Jul 10, 2025
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2024-47252 Details - Not Deferred