Apache HTTP Server 2.4.66 Fixes SSRF Flaw (CVE-2025-59775) Exposing NTLM Hashes on Windows and suexec Bypass

The Apache Software Foundation has rolled out a crucial update for Apache HTTP Server, with version 2.4.66 serving as a cumulative fix for multiple vulnerabilities, including a Server-Side Request Forgery flaw on Windows.

One headline fix is CVE-2025-59775, a moderate-severity SSRF vulnerability involving the interaction between AllowEncodedSlashes On and MergeSlashes Off, which, according to the disclosure, “allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content.” This could enable attackers to harvest credentials from the server environment, making the update a priority for Windows-based administrators.

The release also addresses CVE-2025-66200, a moderate-severity flaw affecting mod_userdir and suexec that can cause CGI scripts to run under an unexpected userid via the AllowOverride FileInfo directive. In addition, three low-severity issues are fixed, including CVE-2025-55753 (an infinite loop in mod_md during failed certificate renewals), CVE-2025-58098 (a query string handling issue with SSI and mod_cgid), and CVE-2025-65082 (unintended variable overrides for CGI programs). Administrators are advised to upgrade to 2.4.66 at their next maintenance window to protect against these identified vectors.