Loading story…
A critical Server-Side Request Forgery (SSRF) vulnerability, tracked as CVE-2025-59775, was identified in Apache HTTP Server running on Windows systems. The flaw occurs when the server is configured with AllowEncodedSlashes On and MergeSlashes Off, allowing attackers to exploit SSRF to leak NTLM hashes to malicious servers. This vulnerability poses a significant risk as it can be exploited remotely without authentication or user interaction, potentially exposing sensitive credentials.
Apache has released version 2.4.66 to address this issue, and users are strongly advised to upgrade to mitigate the risk. The vulnerability is rated as high severity with a CVSS score of 7.5, and its exploitation could lead to the compromise of Windows authentication credentials. The update also addresses a suexec bypass, further enhancing the security posture of affected systems.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2025-59775 was publicly documented as a server-side request forgery vulnerability in Apache HTTP Server on Windows. Public CVE listing made the issue and its classification visible to defenders and researchers.
Apache released HTTP Server version 2.4.66 to fix CVE-2025-59775, an SSRF vulnerability affecting Windows deployments that could expose NTLM hashes. The release also addressed a suexec bypass issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvedetails.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researcher Orange Tsai disclosed **Confusion Attacks**, a set of architectural vulnerabilities in Apache HTTP Server (`httpd`) caused by modules inconsistently interpreting and modifying shared request fields. The flaws—covering Filename, DocumentRoot, and Handler Confusion—were assigned nine CVEs, including `CVE-2024-38472`, `CVE-2024-38473` through `CVE-2024-38477`, and `CVE-2024-39573`. Depending on configuration, exploitation can permit authentication or access-control bypasses, arbitrary local-file and source-code disclosure, SSRF, XSS, local socket access, and possible remote code execution. Apache addressed the reported issues in **httpd 2.4.60**. Risk is highest where deployments use unsafe `RewriteRule` directives, PHP-FPM or `mod_proxy`, CGI-style handlers or redirects, permissive directory and symlink settings, or accessible local package files. Apache's `mod_rewrite` guidance documents hardening changes associated with `CVE-2024-38474` and `CVE-2024-38475`; administrators should avoid enabling `UnsafeAllow3F` and `UnsafePrefixStat` unless they have verified that untrusted input cannot control rewritten query strings or filesystem paths.
Sep 3, 2026
The Apache Software Foundation released **Apache HTTP Server 2.4.67** to fix five vulnerabilities, led by **`CVE-2026-23918`**, an important- to high-severity flaw in the HTTP/2 implementation. Apache said the bug is a **double free** triggered by an early reset that could lead to **remote code execution**, and that it affects **version 2.4.66**. The issue was reported in December 2025 and fixed shortly afterward, with public disclosure following on the `oss-sec` mailing list; Bartlomiej Dmitruk of striga.ai and Stanislaw Strzalkowski of isec.pl were credited with finding it. The 2.4.67 release also patches **`CVE-2026-24072`** in `mod_rewrite`, which can allow local `.htaccess` authors to read arbitrary files as the `httpd` user, along with lower-severity issues in `mod_proxy_ajp`, `mod_md`, and `mod_dav_lock`. Apache and downstream reporting urged organizations running **2.4.66 or earlier** to upgrade immediately, while temporary mitigations for environments that cannot patch at once include disabling **HTTP/2**, removing `mod_dav_lock`, and reviewing `.htaccess` permissions.
Jun 29, 2026
Apache HTTP Server 2.4.39 fixed six vulnerabilities: `CVE-2019-0196`, `CVE-2019-0197`, `CVE-2019-0211`, `CVE-2019-0215`, `CVE-2019-0217`, and `CVE-2019-0220`. The issues included HTTP/2 memory-safety and crash conditions, a local privilege-escalation flaw affecting Unix MPMs, a TLS 1.3 client-certificate authorization bypass, an authentication race that could permit user impersonation, and inconsistent handling of repeated URL-path slashes. F5 reported that its supported products were not affected by `CVE-2019-0196`, `CVE-2019-0197`, or `CVE-2019-0220`. Apache’s broader 2.4 security record also documented risks in optional HTTP/2, proxy, session, TLS, and authentication components, including access-control bypasses and potential information disclosure or remote code execution in `mod_proxy_uwsgi`. Debian subsequently issued an LTS update for Debian 9’s `apache2` package, version `2.4.25-3+deb9u10`, fixing seven vulnerabilities—including `CVE-2020-1927`, `CVE-2020-1934`, `CVE-2020-35452`, `CVE-2021-26690`, `CVE-2021-26691`, `CVE-2021-30641`, and `CVE-2021-31618`—that could cause denial of service or incorrect `MergeSlashes` behavior; affected systems should upgrade their Apache packages.
Aug 29, 2026