Apache HTTP Server: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 5

• High 8.3
  CVE-2025-58098 Public exploit

  Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...

  Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upg…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Dec 5, 2025
• High 7.5
  CVE-2025-55753

  Apache HTTP Server: mod_md (ACME), unintended retry intervals

  An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds. T…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Dec 5, 2025
• High 7.5
  CVE-2025-59775

  Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF

  Server-Side Request Forgery (SSRF) vulnerability  in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off  allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended …

  Apache Software Foundation Apache HTTP Server apache2 Alpine
  Dec 5, 2025
• Medium 6.5
  CVE-2025-65082

  Apache HTTP Server: CGI environment variable override

  Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs. This issue affects A…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Dec 5, 2025
• Medium 5.4
  CVE-2025-66200

  Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo

  mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: fro…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Dec 5, 2025

Revision history

1. 2026-11-01 #40

   Neue Updates von Oracle Linux aufgenommen

2. 2026-09-10 #39

   Neue Updates von Oracle Linux aufgenommen

3. 2026-08-13 #38

   Neue Updates von Gentoo aufgenommen

4. 2026-07-23 #37

   Neue Updates von Oracle Linux aufgenommen

5. 2026-07-19 #36

   Neue Updates von Oracle Linux aufgenommen

6. 2026-06-30 #35

   Neue Updates von SUSE aufgenommen

7. 2026-06-29 #34

   Neue Updates von Oracle Linux aufgenommen

8. 2026-06-17 #33

   Neue Updates von Oracle Linux aufgenommen

9. 2026-06-08 #32

   Neue Updates von IBM aufgenommen

10. 2026-06-02 #31

    Neue Updates von Oracle Linux aufgenommen

11. 2026-06-01 #30

    Neue Updates von SUSE aufgenommen

12. 2026-05-31 #29

    Neue Updates von Ubuntu aufgenommen

13. 2026-05-28 #28

    Neue Updates von Ubuntu und openSUSE aufgenommen

14. 2026-04-06 #27

    Neue Updates von F5 aufgenommen

15. 2026-03-31 #26

    Neue Updates von IBM aufgenommen

16. 2026-03-23 #25

    Neue Updates von Dell aufgenommen

17. 2026-03-09 #24

    Neue Updates von Ubuntu aufgenommen

18. 2026-03-08 #23

    Neue Updates aufgenommen

19. 2026-02-23 #22

    Neue Updates von Red Hat aufgenommen

20. 2026-02-18 #21

    Neue Updates von IBM aufgenommen

21. 2026-02-03 #20

    Neue Updates von IBM aufgenommen

22. 2026-01-25 #19

    Neue Updates von Debian aufgenommen

23. 2026-01-20 #18

    Neue Updates von SUSE aufgenommen

24. 2026-01-19 #17

    Neue Updates von Ubuntu aufgenommen

25. 2026-01-15 #16

    Neue Updates von openSUSE aufgenommen

References

• IBM Security Bulletin 7254766 vom 2025-12-15
  https://www.ibm.com/support/pages/node/7254766
• Apache HTTP Server 2.4 vulnerabilities vom 2025-12-04
  https://httpd.apache.org/security/vulnerabilities_24.html
• oss-sec mailing list CVE-2025-55753 vom 2025-12-04
  https://seclists.org/oss-sec/2025/q4/240
• oss-sec mailing list CVE-2025-58098 vom 2025-12-04
  https://seclists.org/oss-sec/2025/q4/241
• oss-sec mailing list CVE-2025-59775 vom 2025-12-04
  https://seclists.org/oss-sec/2025/q4/242
• oss-sec mailing list CVE-2025-65082 vom 2025-12-04
  https://seclists.org/oss-sec/2025/q4/243
• oss-sec mailing list CVE-2025-66200 vom 2025-12-04
  https://seclists.org/oss-sec/2025/q4/244
• Fedora Security Advisory FEDORA-2025-F46EFDFD9D vom 2025-12-05
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-f46efdfd9d
• Fedora Security Advisory FEDORA-2025-24BF1FFBE7 vom 2025-12-05
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-24bf1ffbe7
• Fedora Security Advisory FEDORA-2025-00A9A7C9B5 vom 2025-12-05
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-00a9a7c9b5
• Fedora Security Advisory FEDORA-2025-83D84EE7F2 vom 2025-12-08
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-83d84ee7f2
• Fedora Security Advisory FEDORA-2025-24282560E4 vom 2025-12-08
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-24282560e4
• Fedora Security Advisory FEDORA-2025-7B0D558AC5 vom 2025-12-08
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-7b0d558ac5
• Microsoft Leitfaden für Sicherheitsupdates vom 2025-12-09
  https://msrc.microsoft.com/update-guide/
• SUSE Security Update SUSE-SU-2025:4488-1 vom 2025-12-19
  https://lists.suse.com/pipermail/sle-security-updates/2025-December/023629.html
• Red Hat Security Advisory RHSA-2025:23732 vom 2025-12-22
  https://access.redhat.com/errata/RHSA-2025:23732
• Red Hat Security Advisory RHSA-2025:23738 vom 2025-12-22
  https://access.redhat.com/errata/RHSA-2025:23738
• HCL Security Bulletin vom 2025-12-20
  https://support.hcl-software.com/community?id=community_blog&sys_id=e990462f33fd7290159a05273e5c7b9c
• Rocky Linux Security Advisory RLSA-2025:23732 vom 2025-12-22
  https://errata.build.resf.org/RLSA-2025:23732
• Oracle Linux Security Advisory ELSA-2025-23738 vom 2025-12-22
  https://linux.oracle.com/errata/ELSA-2025-23738.html
• Oracle Linux Security Advisory ELSA-2025-23739 vom 2025-12-22
  https://linux.oracle.com/errata/ELSA-2025-23739.html
• Oracle Linux Security Advisory ELSA-2025-23919 vom 2025-12-23
  https://linux.oracle.com/errata/ELSA-2025-23919.html
• Red Hat Security Advisory RHSA-2025:23932 vom 2025-12-22
  https://access.redhat.com/errata/RHSA-2025:23932
• Red Hat Security Advisory RHSA-2025:23919 vom 2025-12-23
  https://access.redhat.com/errata/RHSA-2025:23919
• Oracle Linux Security Advisory ELSA-2025-23932 vom 2025-12-23
  https://linux.oracle.com/errata/ELSA-2025-23932.html
• Rocky Linux Security Advisory RLSA-2025:23919 vom 2025-12-23
  https://errata.build.resf.org/RLSA-2025:23919
• Rocky Linux Security Advisory RLSA-2025:23739 vom 2025-12-23
  https://errata.build.resf.org/RLSA-2025:23739
• Rocky Linux Security Advisory RLSA-2025:23738 vom 2025-12-24
  https://errata.build.resf.org/RLSA-2025:23738
• Rocky Linux Security Advisory RLSA-2025:23932 vom 2025-12-24
  https://errata.build.resf.org/RLSA-2025:23932
• SUSE Security Update SUSE-SU-2025:4518-1 vom 2025-12-24
  https://lists.suse.com/pipermail/sle-security-updates/2025-December/023648.html
• Oracle Linux Security Advisory ELSA-2025-23732 vom 2025-12-26
  http://linux.oracle.com/errata/ELSA-2025-23732.html
• Red Hat Security Advisory RHSA-2026:0011 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0011
• Red Hat Security Advisory RHSA-2026:0009 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0009
• Red Hat Security Advisory RHSA-2026:0010 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0010
• Red Hat Security Advisory RHSA-2026:0012 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0012
• Red Hat Security Advisory RHSA-2026:0029 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0029
• Red Hat Security Advisory RHSA-2026:0030 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0030
• Red Hat Security Advisory RHSA-2026:0075 vom 2026-01-06
  https://access.redhat.com/errata/RHSA-2026:0075
• SUSE Security Update SUSE-SU-2026:0020-1 vom 2026-01-05
  https://lists.suse.com/pipermail/sle-security-updates/2026-January/023668.html
• SUSE Security Update SUSE-SU-2026:0019-1 vom 2026-01-05
  https://lists.suse.com/pipermail/sle-security-updates/2026-January/023669.html
• Amazon Linux Security Advisory ALAS2-2025-3099 vom 2026-01-05
  https://alas.aws.amazon.com/AL2/ALAS2-2025-3099.html
• Red Hat Security Advisory RHSA-2026:0093 vom 2026-01-06
  https://access.redhat.com/errata/RHSA-2026:0093
• Red Hat Security Advisory RHSA-2026:0074 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0074
• Red Hat Security Advisory RHSA-2026:0092 vom 2026-01-06
  https://access.redhat.com/errata/RHSA-2026:0092
• Red Hat Security Advisory RHSA-2026:0095 vom 2026-01-06
  https://access.redhat.com/errata/RHSA-2026:0095
• Red Hat Security Advisory RHSA-2026:0094 vom 2026-01-06
  https://access.redhat.com/errata/RHSA-2026:0094
• Red Hat Security Advisory RHSA-2026:0090 vom 2026-01-06
  https://access.redhat.com/errata/RHSA-2026:0090
• Red Hat Security Advisory RHSA-2026:0141 vom 2026-01-06
  https://access.redhat.com/errata/RHSA-2026:0141
• Red Hat Security Advisory RHSA-2026:0171 vom 2026-01-06
  https://access.redhat.com/errata/RHSA-2026:0171
• Red Hat Security Advisory RHSA-2026:0139 vom 2026-01-06
  https://access.redhat.com/errata/RHSA-2026:0139
• Oracle Linux Security Advisory ELSA-2026-30844 vom 2026-06-29
  https://linux.oracle.com/errata/ELSA-2026-30844.html
• IBM Security Bulletin 7256449 vom 2026-01-07
  https://www.ibm.com/support/pages/node/7256449
• Oracle Linux Security Advisory ELSA-2026-0075 vom 2026-01-12
  https://linux.oracle.com/errata/ELSA-2026-0075.html
• openSUSE Security Update OPENSUSE-SU-2026:20030-1 vom 2026-01-15
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O6BK3U2XHMG7GTXYZNR5F5N4SEZTFIYH/
• Ubuntu Security Notice USN-7968-1 vom 2026-01-19
  https://ubuntu.com/security/notices/USN-7968-1
• SUSE Security Update SUSE-SU-2026:20081-1 vom 2026-01-20
  https://lists.suse.com/pipermail/sle-security-updates/2026-January/023817.html
• Debian Security Advisory DLA-4452 vom 2026-01-25
  https://lists.debian.org/debian-lts-announce/2026/01/msg00024.html
• IBM Security Bulletin 7259417 vom 2026-02-04
  https://www.ibm.com/support/pages/node/7259417
• IBM Security Bulletin 7261167 vom 2026-02-18
  https://www.ibm.com/support/pages/node/7261167
• Red Hat Security Advisory RHSA-2026:2995 vom 2026-02-23
  https://access.redhat.com/errata/RHSA-2026:2995
• Red Hat Security Advisory RHSA-2026:2994 vom 2026-02-23
  https://access.redhat.com/errata/RHSA-2026:2994
• Xerox Security Bulletin XRX26-009
  https://security.business.xerox.com/wp-content/uploads/2026/03/Xerox-Security-Bulletin-XRX26-009-for-Xerox-FreeFlow-Print-Server-v9.pdf
• Ubuntu Security Notice USN-7968-2 vom 2026-03-09
  https://ubuntu.com/security/notices/USN-7968-2
• Dell Security Advisory DSA-2026-152 vom 2026-03-23
  https://www.dell.com/support/kbdoc/de-de/000443243/dsa-2026-152-dell-secure-connect-gateway-security-update-for-multiple-third-party-component-vulnerabilities
• IBM Security Bulletin 7268145 vom 2026-03-31
  https://www.ibm.com/support/pages/node/7268145
• F5 Security Advisory K000159875 vom 2026-04-02
  https://my.f5.com/manage/s/article/K000159875
• SUSE Security Update SUSE-SU-2026:2686-1 vom 2026-06-30
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/027074.html
• Ubuntu Security Notice USN-8338-1 vom 2026-05-28
  https://ubuntu.com/security/notices/USN-8338-1
• openSUSE Security Update OPENSUSE-SU-2026:20810-1 vom 2026-05-28
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XOVJ4T6O6CSTSYOREEQDLPHZCQ5QDWLP/
• Ubuntu Security Notice USN-8338-2 vom 2026-05-29
  https://ubuntu.com/security/notices/USN-8338-2
• SUSE Security Update SUSE-SU-2026:21846-1 vom 2026-06-01
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026436.html
• Oracle Linux Security Advisory ELSA-2026-22140 vom 2026-06-02
  https://linux.oracle.com/errata/ELSA-2026-22140.html
• IBM Security Bulletin 7275398 vom 2026-06-08
  https://www.ibm.com/support/pages/node/7275398
• Oracle Linux Security Advisory ELSA-2026-25090 vom 2026-06-17
  https://linux.oracle.com/errata/ELSA-2026-25090.html
• Oracle Linux Security Advisory ELSA-2026-30845 vom 2026-07-17
  http://linux.oracle.com/errata/ELSA-2026-30845.html
• Oracle Linux Security Advisory ELSA-2026-42828 vom 2026-07-23
  https://linux.oracle.com/errata/ELSA-2026-42828.html
• Gentoo Linux Security Advisory GLSA-202608-05 vom 2026-08-14
  https://security.gentoo.org/glsa/202608-05
• Oracle Linux Security Advisory ELSA-2026-64794 vom 2026-09-10
  https://linux.oracle.com/errata/ELSA-2026-64794-0.html
• Oracle Linux Security Advisory ELSA-2026-92616 vom 2026-11-02
  http://linux.oracle.com/errata/ELSA-2026-92616.html