Description

Server-Side Request Forgery (SSRF) vulnerability  in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off  allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.

Remediation

References

CVE-2025-59775

Related Vulnerabilities

Craft CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-12823)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-35653)

Joomla! Core 1.5.x Spam (1.5.0 - 1.5.6)

WordPress Plugin Wbcom Designs-BuddyPress Group Reviews Security Bypass (2.8.3)

PHP Numeric Errors Vulnerability (CVE-2016-10158)

Severity

High

Classification

CVE-2025-59775 CWE-918 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities