Apache HTTP server 2.4.66 released, addressing 5 vulnerabilities and introducing several changes.
Vulnerabilities addressed (the first 2 have a medium level of severity, and the others are low):
- CVE-2025-66200 — running a CGI script under a different user in configurations with mod_userdir and suexec through manipulation of the 'RequestHeader' directive in the .htaccess file (if allowed in .htaccess).
- CVE-2025-59775 — SSRF vulnerability (Server-Side Request Forgery) leading to NTLM hash leakage to another server when using Apache httpd on Windows with 'AllowEncodedSlashes On' and 'MergeSlashes Off' settings.
- CVE-2025-65082 — environmental variable overriding for CGI scripts due to improper escaping of control characters (setting variables can override computed variable values) server for CGI).
- CVE-2025-58098 — passing a escaped query string to the SSI (Server Side Includes) directive '' in configurations with mod_cgid instead of mod_cgi.
- CVE-2025-55753 — sending continuous (without delays between requests) repeat ACME requests for certificate updates in the mod_md module after numerous failures to update an expired certificate.
Among non-security-related improvements:
- The mod_md module implementing the ACME protocol has been updated to version 2.6.6:
- Support for the ARI protocol extension (ACME Renewal Information) has been added, allowing obtaining information on the need for certificate renewal and selecting the optimal time for renewal. The directive 'MDRenewViaARI on|off' has been proposed to enable ARI.
- The 'MDInitialDelay' directive has been implemented to set a delay for certificate checking after the server restarts.
- The default value of the MDRetryDelay parameter (delay before retrying after an error) has been increased to 30 seconds.
- Support discontinued VPN-Tailscale şəbəkəsində.
- Errors and memory leaks fixed.
- The mod_http2 module has been updated to version 2.0.35, which introduces the 'H2MaxStreamErrors' directive to set a limit on the number of stream errors, after which the connection will be closed.
- In mod_http2, proper handling of responses with code 3 from mod_cache has been established.
- In mod_proxy_http2, the 'ProxyErrorOverride' directive has been implemented to override error codes.
- In mpm_common, the 'ListenTCPDeferAccept' directive has been added, through which you can set the value of the TCP_DEFER_ACCEPT option (activation only when data arrives on the socket) for the listening socket.
- In mod_ssl, the 'SSLVHostSNIPolicy' directive has been added to configure compatibility rules for virtual hosts.
Mənbə: opennet.ru
