onyx

onyx --cves cve-2023-25690

CVE-2023-25690

CRITKEVPOCApache HTTP Server
score
<0.1
cvss
9.8
epss
84.5%
published
2023-03-07
kev added
2024-07-25
first seen

Apache HTTP Server versions 2.4.0 through 2.4.55 contain a HTTP Request Smuggling caused by vulnerable mod_proxy configurations with RewriteRule or ProxyPassMatch that match user-supplied URL data and re-insert it into proxied requests, letting attackers bypass access controls, proxy unintended URLs, and poison caches, exploit requires specific configuration with variable substitution.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2023-03-07 — PublishedP2024-07-25 — Added to CISA KEVK2026-10-21 — Tracked by OnyxT2026-10-21 — Public PoC: http://packetstormsecurity.com/files/176334/Apache-2.4.55-mod_proxy-HTTP-Request-Smuggling.htmlXscore2026-10-21: score <0.1<0.1epss2026-09-22: epss 84.5%2026-09-23: epss 84.5%2026-09-24: epss 84.5%2026-09-25: epss 84.5%2026-09-26: epss 84.5%2026-09-27: epss 84.5%2026-09-28: epss 84.5%2026-09-29: epss 84.5%2026-09-30: epss 84.5%2026-10-01: epss 84.5%2026-10-02: epss 84.5%2026-10-03: epss 84.5%2026-10-04: epss 84.5%2026-10-05: epss 84.5%2026-10-06: epss 84.5%2026-10-07: epss 84.5%2026-10-08: epss 84.5%2026-10-09: epss 84.5%2026-10-10: epss 84.5%2026-10-11: epss 84.5%2026-10-12: epss 84.5%2026-10-13: epss 84.5%2026-10-14: epss 84.5%2026-10-15: epss 84.5%2026-10-16: epss 84.5%2026-10-18: epss 84.5%2026-10-19: epss 84.5%2026-10-20: epss 84.5%2026-10-21: epss 84.5%84.5%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Added to CISA KEV
  3. Tracked by Onyx
  4. Public PoC http://packetstormsecurity.com/files/176334/Apache-2.4.55-mod_proxy-HTTP-Request-Smuggling.html

Exploit availability

Weaknesses

CWE-444

References 5