Back Linuxsecurity

Fedora 42: Critical Update for httpd to Address Severe Security Flaws

Linuxsecurity •LinuxSecurity Advisories • December 25, 2025

The Apache HTTP Server is a powerful, efficient, and extensible web server. Update Information : version update security update

The Apache HTTP Server is a powerful, efficient, and extensible

version update security update

* Tue Dec 9 2025 Lubo\u0161 Uhliarik - 2.4.66-1 - new version 2.4.66

[ 1 ] Bug #2419768 - httpd-2.4.66 is available [ 2 ] Bug #2420206 - CVE-2025-58098 httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... [fedora-42] [ 3 ] Bug #2420207 - CVE-2025-58098 httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... [fedora-43] [ 4 ] Bug #2420208 - CVE-2025-66200 httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo [fedora-42] [ 5 ] Bug #2420209 - CVE-2025-66200 httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo [fedora-43] [ 6 ] Bug #2420214 - CVE-2025-65082 httpd: Apache HTTP Server: CGI environment variable override [fedora-42] htt... Read the Full Advisory

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-f7c75ffee2' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora Releases Critical Update for Apache HTTP Server to Fix Security Flaws Fedora has issued a critical security update for the Apache HTTP Server, addressing severe vulnerabilities identified as CVE-2025-58098. The update, version 2.4.66, was released on December 9, 2025, and affects users of Fedora 42 and Fedora 43. Users are advised to apply the update to mitigate potential security risks. 2 sources 64

Extracted Entities

CVEs (3)

CVE-2025-58098 CVE-2025-65082 CVE-2025-66200