CVE-2005-2700: Apache HTTP Server

High severity, CVSS 10.0. EPSS: 30.6% chance of exploitation in the next 30 days.

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

Affected products

• Apache HTTP Server: from 2.0.35, before 2.0.55 (fixed in 2.0.55)
• Canonical Ubuntu Linux: version 4.10 only; version 5.04 only
• Debian Debian Linux: version 3.0 only; version 3.1 only

Published 2005-09-06. Last modified 2026-06-16.