CVE-2025-59775: Apache HTTP Server

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

Server-Side Request Forgery (SSRF) vulnerability  in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off  allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.

Affected products

• Apache HTTP Server: from 2.4.0, before 2.4.66 (fixed in 2.4.66)

Published 2025-12-05. Last modified 2026-09-25.