Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.

An update of the httpd package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes     On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and     malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.
    (CVE-2025-59775)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.66. It is, therefore, affected by multiple vulnerabilities:

- Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content. (CVE-2025-59775)

- A security bypass vulnerability exists involving the interaction between mod_userdir and suexec. Users with access to use the RequestHeader directive in .htaccess via AllowOverride FileInfo can bypass restrictions and cause some CGI scripts to run under an unexpected userid. (CVE-2025-66200)

- An integer overflow in mod_md (ACME) in Apache HTTP Server allows for unintended retry intervals. In the case of failed ACME certificate renewal, the backoff timer can become 0, causing attempts to renew the certificate to repeat without delays (infinite loop) until success. (CVE-2025-55753)

- A vulnerability in mod_cgid allows for the injection of query strings into command executions. Apache HTTP Server with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. (CVE-2025-58098)

- Improper Neutralization of Escape, Meta, or Control Sequences in Apache HTTP Server allows environment variables set via the Apache configuration to unexpectedly supersede variables calculated by the server for CGI programs. (CVE-2025-65082) Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of httpd installed on the remote host is prior to 2.4.66. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-338-01 advisory.

    New httpd packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6ebe4a30-d138-11f0-af8c-8447094a420f advisory.

    The Apache httpd project reports:
    See                 changelog or                 2.4 vulnerabilities for details.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
278503	Photon OS 5.0: Httpd PHSA-2025-5.0-0710	Nessus	PhotonOS Local Security Checks	high
277693	Linux Distros Unpatched Vulnerability : CVE-2025-59775	Nessus	Misc.	high
115071	Apache 2.4.x < 2.4.66 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
277506	Slackware Linux 15.0 / current httpd Multiple Vulnerabilities (SSA:2025-338-01)	Nessus	Slackware Local Security Checks	high
277483	FreeBSD : Apache httpd -- Multiple vulnerabilities (6ebe4a30-d138-11f0-af8c-8447094a420f)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2025-59775

high

Tenable Plugins

high

high

high

high

high