Description
Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via
mod_rewrite or apache expressions that pass unvalidated request input.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.63.
Note: The Apache HTTP Server Project will be setting a higher bar for accepting vulnerability reports regarding SSRF via UNC paths.
The server offers limited protection against administrators directing the server to open UNC paths.
Windows servers should limit the hosts they will connect over via SMB based on the nature of NTLM authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server | 2.4.0 – ≤ 2.4.63 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | apache2 | 2.4.65-1~deb11u1 | DLA-4270-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2 | 2.4.64-1.1 | openSUSE-SU-2025:15360-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | apache2 | 2.4.64-r0 | — |
| Alpine v3.23 | apache2 | 2.4.64-r0 | — |
| Alpine v3.22 | apache2 | 2.4.64-r0 | — |
| Alpine v3.21 | apache2 | 2.4.64-r0 | — |
| Alpine v3.20 | apache2 | 2.4.64-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | apache2 | 2.4.64-r0 | — |
Advisories 5
- WID-SEC-2025-1529 Apache HTTP Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-1203 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- openSUSE-SU-2025:15360-1 apache2-2.4.64-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-4270-1 apache2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2025-1850 Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Nov 17, 2025
References
- https://httpd.apache.org/security/vulnerabilities_24.html vendor-advisory