CVE-2025-53020: Apache HTTP Server memory-leak denial of service
The short version: Apache HTTP Server has a memory-management flaw (CVE-2025-53020) — memory that isn't released when it should be — that can be driven toward resource exhaustion and denial of service. It affects availability only, there's no code execution, and it isn't known to be exploited in the wild. Upgrade on your normal cadence and you're clear. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate — availability-only DoS, not known exploited |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| EPSS | ~4.41% · 90.25th percentile (2026-07-17) |
| In CISA KEV? | No |
| Known exploited? | Not known to be exploited in the wild |
| Vulnerability type | CWE-401 late release of memory after effective lifetime → denial of service |
| Requires authenticated session? | No — pre-authentication |
| Affected | Apache HTTP Server 2.4.17 through 2.4.63 |
| Fixed in | Apache HTTP Server 2.4.64 |
What you need to know
CVE-2025-53020 is a memory-lifetime flaw in Apache HTTP Server: memory that should be freed after its useful life isn't, and under the right request patterns that leak accumulates. Pushed far enough, it exhausts resources and the server stops serving — a denial-of-service condition.
The honest scope:
- It's availability, not confidentiality or integrity. The NVD vector is explicit — no data disclosure, no code execution, only an availability impact.
- It affects a wide version band. Everything from 2.4.17 through 2.4.63 is in range, so a lot of long-running installs qualify; the fix landed in 2.4.64.
- It isn't a fire drill. It's not in KEV, there's no confirmed in-the-wild exploitation, and the EPSS score is low.
How serious we see it
Moderate — and here the base score reads higher than the practical risk.
NVD scores it 7.5 (High) because an unauthenticated attacker can cause an availability impact over the network. But the impact is bounded to denial of service — no code execution, no data leak — and it isn't being exploited in the wild. For most operators this is routine patch hygiene, not an emergency. The reassuring part is simple: the fix is published, the affected range is easy to check, and upgrading closes it outright.
Recommendations
Straight from the Apache HTTP Server security guidance:
- Upgrade to 2.4.64 (or later) on your normal maintenance cadence.
- Confirm your version. Check whether any internet-facing Apache HTTP Server is in the 2.4.17–2.4.63 range.
- Watch availability signals. Monitor for abnormal memory growth or request patterns against exposed web servers in the interim.
- Restrict where practical. Limit exposure of non-public Apache instances to trusted networks.
How BreachRisk sees it
BreachRisk discovers your internet-facing web servers from little more than your domain, fingerprints the Apache HTTP Server version, and flags whether it falls in the affected range for this CVE. Because this one is availability-only and not in KEV, it's surfaced in proportion — a real finding to fold into your patch cycle, not a false alarm dressed up as a crisis.
That calibrated, outside-in view is the value: you see the affected servers ranked by how they actually matter, so routine issues stay routine and the genuinely urgent ones stand out.