CVE-2025-59775

HIGH | Platform: macOS | Changelog

CVE Details

Description

Server-Side Request Forgery (SSRF) vulnerability

in Apache HTTP Server on Windows

with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content

Users are recommended to upgrade to version 2.4.66, which fixes the issue.

CVSS 3.1 Score

Metric	Value
Base Score	7.5 (HIGH)
Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Weakness

CWE-918

References

Apple Security Advisory
NVD Entry
https://httpd.apache.org/security/vulnerabilities_24.html (Vendor Advisory)
http://www.openwall.com/lists/oss-security/2025/12/04/6 (Issue Tracking, Third Party Advisory)