Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.

The versions of HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2026 CPU advisory.

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported     versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. While the     vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope     change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all Oracle HTTP Server accessible data as well as unauthorized     access to critical data or complete access to all Oracle HTTP Server accessible data. (CVE-2026-34291)

  - Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi)     passes the shell-escaped query string to #exec cmd=... directives. This issue affects Apache HTTP Server     before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue. (CVE-2025-58098)

  - Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes     to a malicious server via mod_rewrite or apache expressions that pass unvalidated request input. This issue     affects Apache HTTP Server: from 2.4.0 through 2.4.63. Note: The Apache HTTP Server Project will be setting     a higher bar for accepting vulnerability reports regarding SSRF via UNC paths. The server offers limited     protection against administrators directing the server to open UNC paths. Windows servers should limit the     hosts they will connect over via SMB based on the nature of NTLM authentication. (CVE-2024-43394)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 26.x prior to 26.4. It is, therefore, affected by multiple vulnerabilities:

  - Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not     mod_cgi) passes the shell-escaped query string to #exec cmd=... directives. This issue affects Apache     HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.
    (CVE-2025-58098)

  - When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol     redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the     bearer token to the new target host. (CVE-2025-14524)

  - An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30     days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then     are repeated without delays until it succeeds. This issue affects Apache HTTP Server: from 2.4.30 before     2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue. (CVE-2025-55753)

  - Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes     On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and     malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.
    (CVE-2025-59775)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability     exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The     vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image     data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-     bounds memory access. This issue has been patched in version 1.6.51. (CVE-2025-64505)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 14.x prior to 14.8.5. It is, therefore, affected by multiple vulnerabilities:

  - Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not     mod_cgi) passes the shell-escaped query string to #exec cmd=... directives. This issue affects Apache     HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.
    (CVE-2025-58098)

  - When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol     redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the     bearer token to the new target host. (CVE-2025-14524)

  - An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30     days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then     are repeated without delays until it succeeds. This issue affects Apache HTTP Server: from 2.4.30 before     2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue. (CVE-2025-55753)

  - Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes     On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and     malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.
    (CVE-2025-59775)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability     exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The     vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image     data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-     bounds memory access. This issue has been patched in version 1.6.51. (CVE-2025-64505)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 15.x prior to 15.7.5. It is, therefore, affected by multiple vulnerabilities:

  - A path handling issue was addressed with improved logic. This issue is fixed in macOS Tahoe 26.3, macOS     Sonoma 14.8.4, iOS 18.7.5 and iPadOS 18.7.5, visionOS 26.3, iOS 26.3 and iPadOS 26.3, Safari 26.3. A     remote user may be able to write arbitrary files. (CVE-2026-20660)

  - When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol     redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the     bearer token to the new target host. (CVE-2025-14524)

  - An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30     days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then     are repeated without delays until it succeeds. This issue affects Apache HTTP Server: from 2.4.30 before     2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue. (CVE-2025-55753)

  - Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not     mod_cgi) passes the shell-escaped query string to #exec cmd=... directives. This issue affects Apache     HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.
    (CVE-2025-58098)

  - Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes     On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and     malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.
    (CVE-2025-59775)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4452 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4452-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     January 24, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : apache2     Version        : 2.4.66-1~deb11u1     CVE ID         : CVE-2025-55753 CVE-2025-58098 CVE-2025-59775 CVE-2025-65082                      CVE-2025-66200     Debian Bug     : 1121926

    Multiple vulnerabilities were fixed for apache httpd a popular webserver.

    CVE-2025-55753

        An integer overflow was found in the case of failed ACME certificate         renewal leads, after a number of failures (~30 days in default configurations),         to the backoff timer becoming 0. Attempts to renew the certificate         then are repeated without delays until it succeeds

    CVE-2025-58098

        Apache with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi)         passes the shell-escaped query string to #exec cmd=... directives.

    CVE-2025-59775

        A Server-Side Request Forgery (SSRF) vulnerability was found         in Apache HTTP Server on Windows with AllowEncodedSlashes On         and MergeSlashes Off  allows to potentially leak NTLM hashes to         a malicious server via SSRF

    CVE-2025-65082

        An Improper Neutralization of Escape, Meta, or Control Sequences         vulnerability was found in Apache HTTP Server through environment         variables set via the Apache configuration unexpectedly superseding         variables calculated by the server for CGI programs.

    CVE-2025-66200

        An mod_userdir+suexec bypass, via AllowOverride FileInfo         vulnerability was found in Apache HTTP Server.
        Users with access to use the RequestHeader directive         in htaccess can cause some CGI scripts to run under an unexpected userid.

    For Debian 11 bullseye, these problems have been fixed in version     2.4.66-1~deb11u1.

    We recommend that you upgrade your apache2 packages.

    For the detailed security status of apache2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/apache2

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the httpd package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes     On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and     malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.
    (CVE-2025-59775)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.66. It is, therefore, affected by multiple vulnerabilities:

- Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content. (CVE-2025-59775)

- A security bypass vulnerability exists involving the interaction between mod_userdir and suexec. Users with access to use the RequestHeader directive in .htaccess via AllowOverride FileInfo can bypass restrictions and cause some CGI scripts to run under an unexpected userid. (CVE-2025-66200)

- An integer overflow in mod_md (ACME) in Apache HTTP Server allows for unintended retry intervals. In the case of failed ACME certificate renewal, the backoff timer can become 0, causing attempts to renew the certificate to repeat without delays (infinite loop) until success. (CVE-2025-55753)

- A vulnerability in mod_cgid allows for the injection of query strings into command executions. Apache HTTP Server with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. (CVE-2025-58098)

- Improper Neutralization of Escape, Meta, or Control Sequences in Apache HTTP Server allows environment variables set via the Apache configuration to unexpectedly supersede variables calculated by the server for CGI programs. (CVE-2025-65082) Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of httpd installed on the remote host is prior to 2.4.66. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-338-01 advisory.

    New httpd packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6ebe4a30-d138-11f0-af8c-8447094a420f advisory.

    The Apache httpd project reports:
    See                 changelog or                 2.4 vulnerabilities for details.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
309969	Oracle HTTP Server (April 2026 CPU)	Nessus	Web Servers	high
309968	Oracle HTTP Server (April 2026 CPU)	Nessus	Web Servers	high
303481	macOS 26.x < 26.4 Multiple Vulnerabilities (126794)	Nessus	MacOS X Local Security Checks	high
303479	macOS 14.x < 14.8.5 Multiple Vulnerabilities (126796)	Nessus	MacOS X Local Security Checks	medium
303478	macOS 15.x < 15.7.5 Multiple Vulnerabilities (126795)	Nessus	MacOS X Local Security Checks	high
296510	Debian dla-4452 : apache2 - security update	Nessus	Debian Local Security Checks	high
278503	Photon OS 5.0: Httpd PHSA-2025-5.0-0710	Nessus	PhotonOS Local Security Checks	high
277693	Linux Distros Unpatched Vulnerability : CVE-2025-59775	Nessus	Misc.	high
115071	Apache 2.4.x < 2.4.66 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
277506	Slackware Linux 15.0 / current httpd Multiple Vulnerabilities (SSA:2025-338-01)	Nessus	Slackware Local Security Checks	high
277483	FreeBSD : Apache httpd -- Multiple vulnerabilities (6ebe4a30-d138-11f0-af8c-8447094a420f)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2025-59775

high

Tenable Plugins

high

high

high

medium

high

high

high

high

high

high

high