CVE-2025-23048: Apache SNI/AWS/HAProxy TLS Issue

After Apache 2.4.65 (CVE-2025-23048), SSL-enabled sites may see 'Misdirected Request' (AH02032) errors if SNI is missing or mismatched, especially with AWS ALB or misconfigured HAProxy.This is due to stricter SNI/Host header checks for TLS vhosts.Workarounds: use wildcard/unified certs, separate ports per vhost, or enable dynamic SNI in HAProxy. See full note for details.

['apt-listchanges: News', '---------------------', '', 'apache2 (2.4.65-1~deb12u1) bookworm; urgency=medium', '', '  Following the resolution of CVE-2025-23048,', '  some SSL-enabled websites may begin encountering', '  the error (AH02032):', '  .', '    Misdirected Request:', '    The client needs a new connection for this request as the', '    requested host name does not match the Server Name Indication', '    (SNI) in use for this connection.', '  .', '  This behavior is particularly noticeable with AWS Application', '  Load Balancers. Although they support intelligent SNI handling,', '  they do not (as of this writing) relay SNI data to the target', "  server, resulting in failed connections when hostnames don't align.", '  .', '  Without an SNI provided by the client, there is nothing httpd', '  can do to determine which vhost/configuration should be', '  used to provide the correct certificate (and TLS authentication', '  eventually) whenever multiple vhosts listen on the same IP:port.', '  .', "  That's because reading the HTTP Host header necessarily has to", '  happen after the TLS handshake/auth/decryption (and later', '  renegotiation is not an option with TLSv1.3).', '  .', '  So those connections fall back to the first vhost declared on', '  the IP:port for the TLS handshake part, and if the request', '  Host header finally matches a different vhost with a different', "  TLS configuration it's rejected with AH02032.", '  .', '  Before 2.4.64 the check was not accurate and would allow that,', '  with security implications.', '  .', '  As a workaround, you may (after a risk analysis) generate a', "  wildcard certificate. If you're managing multiple domains,", '  consolidate them into a single certificate by including each', '  wildcard domain as an alias. Then, update the Apache configuration', '  to reference this unified certificate.', '  .', '  Another possible workaround is to configure each virtual host to', '  listen on a separate port. This approach avoids SNI-related issues', '  by ensuring that each vhost is uniquely addressed through its own', '  connection endpoint, thereby allowing distinct TLS configurations', '  without ambiguity.', '  .', '  This error may also stem from a misconfigured HAProxy setup.', '  In such cases, enabling dynamic SNI handling on HAProxy might be', '  necessary to ensure that the correct hostname is passed through', '  during the TLS handshake. After risk analysis, it could be done', '  by using "sni req.hdr(Host)" directive.', '', ' -- Bastien Roucaries <rouca@debian.org>  Fri, 25 Jul 2025 20:33:38 +0200']
version 1  ·  created 2026-02-18  ·  tags cve, apache, tls, sni, aws, haproxy