PT-2025-49182 · Apache+3 · Apache Http Server+3

Published 2025-09-10 · Updated 2026-03-24 · CVE-2025-59775

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.66

Description An issue exists in Apache HTTP Server on Windows when AllowEncodedSlashes is enabled and MergeSlashes is disabled. This can allow for Server-Side Request Forgery (SSRF), potentially leading to the leakage of NTLM hashes to a malicious server through crafted requests or content. The issue enables an attacker to make requests on behalf of the server, potentially accessing internal resources.

Recommendations Upgrade to version 2.4.66 to resolve this issue.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2025-15293

BIT-APACHE-2025-59775

CVE-2025-59775

OPENSUSE-SU-2025:15808-1

OPENSUSE-SU-2026:20810-1

RHSA-2026:5156

SUSE-SU-2026:21846-1

Affected Products

Alt Linux

Apache Http Server

Apple Macos

Red Os

References · 43

• https://httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-59775 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15293 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15808-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-59775 · Vendor Advisory
• http://repo.red-soft.ru/redos/8.0/x86_64/updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59775 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2025-59775 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/730320 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59775 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-59775 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-59775 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-59775 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-59775 · Vendor Advisory
• https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2025-59775 · Note