CVE-2025-59775 — Server-Side Request Forgery in Apache Http Server

CWE-918 — Server-Side Request Forgery8 documents7 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 78.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Http ServerApache Software Foundation Apache Http Server
Timeline
PublishedDec 5
Latest updateDec 9

Description

Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDapache/http_server2.4.0 — 2.4.66

🔴Vulnerability Details

4
CVEList
Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF↗2025-12-05
▶
OSV
CVE-2025-59775: Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potential↗2025-12-05
▶
GHSA
GHSA-7w72-74p3-5cfq: Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potenti↗2025-12-05
▶
OSV
CVE-2025-59775: Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potenti↗2025-12-05
▶

📋Vendor Advisories

3
Microsoft
Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF↗2025-12-09
▶
Red Hat
httpd: Apache HTTP Server: NTLM Leakage on Windows via SSRF↗2025-12-05
▶
Debian
CVE-2025-59775: apache2 - Server-Side Request Forgery (SSRF) vulnerability  in Apache HTTP Server on Win...↗2025
▶
CVE-2025-59775 — Server-Side Request Forgery in Apache | cvebase