BIT-apache-2025-59775

vendorUSosv

Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF

view advisory published 2025-12-09Licence: per source

Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-59775US	—	0.82% (57th)	—	2025-12-05
Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2025/12/04/6ADVISORY
https://httpd.apache.org/security/vulnerabilities_24.htmlADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2025-59775WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan