CVE-2025-59775
High · 7.5CVSS
7.5
EPSS
0.8%
Published
Dec 5, 2025
CISA due date
—
The record
Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Bitnami | apache | 2.4.0 | 2.4.66 |
| openSUSE:Tumbleweed | apache2 | 0 | 2.4.66-1.1 |
Related vulnerabilities
- CVE-2025-58098 Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and… Also affects apache
- CVE-2025-65082 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache… Also affects apache
- CVE-2025-66200 mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Also affects apache
- CVE-2025-55753 An integer overflow in the case of failed ACME certificate renewal leads, after a number… Also affects apache
- CVE-2021-41773 A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. Also affects apache
- CVE-2026-28780 Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. Also affects apache2
- CVE-2026-29168 Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP… Also affects apache2
- CVE-2026-33007 A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and… Also affects apache2