CVE-2025-59775

Server-Side Request Forgery (SSRF) vulnerability  in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off  allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.

Score

CVSS 3.1 7.5 High

Status

Analyzed - security@apache.org

Published

2025-12-05

Last modified

2025-12-05

Weaknesses

CWE-918

Affected products

• Http Server (Apache)
• Apache Http Server (Apache Software Foundation)

References

• https://httpd.apache.org/security/vulnerabilities_24.html
• http://www.openwall.com/lists/oss-security/2025/12/04/6