The release of Apache HTTP Server 2.4.66 has been announced, addressing 5 vulnerabilities and implementing several dozen changes.
Fixed vulnerabilities (the first 2 have a moderate level of severity, while the others are low):
- CVE-2025-66200 — execution of a CGI script under a different user in configurations with mod_userdir and suexec through manipulation of the "RequestHeader" directive in the .htaccess file (if its use in .htaccess is allowed).
- CVE-2025-59775 — SSRF vulnerability (Server-Side Request Forgery) leading to leakage of NTLM hash to another server when using Apache httpd on Windows in configurations with settings "AllowEncodedSlashes On" and "MergeSlashes Off".
- CVE-2025-65082 — overriding environment variables for CGI scripts due to improper escaping of control characters (setting variables in the configuration may override the values calculated for CGI). proxy server CVE-2025-58098 — passing an escaped query string to the SSI (Server Side Includes) directive "" in configurations with mod_cgid instead of mod_cgi.
- CVE-2025-55753 — sending continuous (without delay between requests) repeat ACME requests for certificate renewal in the mod_md module after many failures when trying to renew an expired certificate.
- Among the non-security-related improvements:
The mod_md module with ACME protocol implementation has been updated to version 2.6.6:
- Support for the ARI (ACME Renewal Information) protocol extension has been added, allowing to obtain information about the need to renew certificates and to choose the optimal time for renewal. The directive "MDRenewViaARI on|off" is suggested to enable ARI.
- The directive "MDInitialDelay" has been implemented to set a delay for certificate checking after the server restarts.
- The default value of the MDRetryDelay parameter (the delay before retrying after an error) has been increased to 30 seconds.
- - Tailscale networks.
- Windows RT VPNFixed bugs and memory leaks.
- The mod_http2 module has been updated to version 2.0.35, which includes the directive "H2MaxStreamErrors" for setting a limit on the number of stream errors, after which the connection will be closed.
- In mod_http2, proper handling of responses with code 3 from mod_cache has been established.
- In mod_proxy_http2, the directive "ProxyErrorOverride" has been implemented to override error codes.
- The mod_proxy_http2 module implements the "ProxyErrorOverride" directive to override error codes.
- The directive "ListenTCPDeferAccept" has been added to mpm_common, allowing you to set the value of the TCP_DEFER_ACCEPT option (activation only when data arrives at the socket) for the listening socket.
- The directive "SSLVHostSNIPolicy" has been added to mod_ssl for configuring compatibility rules for virtual hosts.
Source: opennet.ru
