CVE-2025-59775

HighCVSS 7.5/10Last modified Sep 25, 2026

Description

Server-Side Request Forgery (SSRF) vulnerability

in Apache HTTP Server on Windows

with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content

Users are recommended to upgrade to version 2.4.66, which fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache HTTP Server	>= 2.4.0, <= 2.4.65

References

https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
http://www.openwall.com/lists/oss-security/2025/12/04/6Issue Tracking, Third Party Advisory

Timeline

Published: Dec 5, 2025
Last modified: Sep 25, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-597764.0A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthen CVE-2025-597778.7NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the CVE-2025-597787.5When the Allowed IP Addresses feature is configured on the F5OS-C partition control plane, undisclosed traffic can cause multiple containers CVE-2025-59788.8A vulnerability was found in Tenda FH1202 1.2.0.14. It has been classified as critical. Affected is the function fromVirtualSer of the file CVE-2025-597807.5General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to se CVE-2025-597817.5When DNS cache is configured on a BIG-IP or BIG-IP Next CNF virtual server, undisclosed DNS queries can cause an increase in memory resource CVE-2025-597837.2API endpoint for user synchronization in 2N Access Commander version 3.4.1 did not have a sufficient input validation allowing for OS comman CVE-2025-597847.22N Access Commander version 3.4.1 and prior is vulnerable to log pollution. Certain parameters sent over API may be included in the logs wit CVE-2025-597857.2Improper validation of API end-point in 2N Access Commander version 3.4.2 and prior allows attacker to bypass password policy for backup fil CVE-2025-597869.82N Access Commander version 3.4.2 and prior improperly invalidates session tokens, allowing multiple session cookies to remain active after CVE-2025-597876.52N Access Commander application version 3.4.2 and prior returns HTTP 500 Internal Server Error responses when receiving malformed or manipul CVE-2025-597885.4Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0