{"id":150696,"date":"2025-12-05T17:11:54","date_gmt":"2025-12-05T15:11:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-http-servera-apache-2-4-66-s-ustraneniem-5-uyazvimostej"},"modified":"2025-12-05T17:11:54","modified_gmt":"2025-12-05T15:11:54","slug":"reliz-http-servera-apache-2-4-66-s-ustraneniem-5-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/reliz-http-servera-apache-2-4-66-s-ustraneniem-5-uyazvimostej","title":{"rendered":"Release of Apache HTTP Server 2.4.66 addressing 5 vulnerabilities","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>The release of Apache HTTP Server 2.4.66 has been announced, addressing 5 vulnerabilities and implementing several dozen changes.    <\/p>\n<p>Fixed vulnerabilities (the first 2 have a moderate level of severity, while the others are low):  <\/p>\n<ul>\n<li class=\"l\"> CVE-2025-66200 \u2014 organization of running CGI scripts under a different user in configurations with mod_userdir and suexec through manipulation of the &#171;RequestHeader&#187; directive in the .htaccess file (if its use in .htaccess is allowed).\n<li class=\"l\"> CVE-2025-59775 \u2014 SSRF vulnerability (Server-Side Request Forgery) leading to NTLM hash leakage to another server when using Apache httpd on the Windows platform in configurations with &#171;AllowEncodedSlashes On&#187; and &#171;MergeSlashes Off&#187; settings.\n<li class=\"l\"> CVE-2025-65082 \u2014 overriding environment variables for CGI scripts due to improper escaping of control characters (setting variables in configuration can override the values of computed variables. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/en\/server\/dts-prohoster\/\"   title=\"proxy server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3114\">proxy server<\/a> CVE-2025-58098 \u2014 passing an escaped query string to the SSI (Server Side Includes) directive \"\" in configurations with mod_cgid instead of mod_cgi.\n<li class=\"l\"> CVE-2025-58098 \u2014 passing an escaped query string to the SSI (Server Side Includes) directive &#171;&lt;!&#8212;#exec cmd=&#8230;&#8212;&gt;&#187; in configurations with mod_cgid instead of mod_cgi.\n<li class=\"l\"> CVE-2025-55753 \u2014 sending continuous (with no delay between requests) repeated ACME requests for certificate renewal in the mod_md module after a large number of failures when attempting to renew an expired certificate.    <\/ul>\n<p>The mod_md module with ACME protocol implementation has been updated to version 2.6.6:   <\/p>\n<ul>\n<li class=\"l\"> Support for the ARI (ACME Renewal Information) protocol extension has been added, allowing to obtain information about the need to renew certificates and to choose the optimal time for renewal. The directive \"MDRenewViaARI on|off\" is suggested to enable ARI.\n<ul>\n<li class=\"l\"> Support has been added for the ARI (ACME Renewal Information) protocol extension, which allows for obtaining information on the need to renew certificates and choosing the optimal time for renewal. To enable ARI, the directive &#171;MDRenewViaARI on|off&#187; is proposed.\n<li class=\"l\"> The &#171;MDInitialDelay&#187; directive has been implemented to set a delay for checking the certificate after the server restarts.\n<li class=\"l\"> - Tailscale networks.\n<li class=\"l\"> Windows RT <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/en\/vpn\/\"   title=\"VPN\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"291\">VPN<\/a>Fixed bugs and memory leaks.\n<li class=\"l\"> The mod_http2 module has been updated to version 2.0.35, which includes the directive \"H2MaxStreamErrors\" for setting a limit on the number of stream errors, after which the connection will be closed.   <\/ul>\n<li class=\"l\"> The mod_http2 module has been updated to version 2.0.35, which introduced the &#171;H2MaxStreamErrors&#187; directive to set a limit on the number of stream errors, beyond which the connection will be closed.\n<li class=\"l\">  In mod_proxy_http2, the directive \"ProxyErrorOverride\" has been implemented to override error codes.\n<li class=\"l\"> In mod_proxy_http2, the &#171;ProxyErrorOverride&#187; directive is implemented to override error codes.\n<li class=\"l\"> In mpm_common, the &#171;ListenTCPDeferAccept&#187; directive has been added, through which the value of the TCP_DEFER_ACCEPT option (activation only upon receiving data to the socket) can be set for the listening socket.\n<li class=\"l\"> In mod_ssl, the &#171;SSLVHostSNIPolicy&#187; directive has been added for configuring compatibility rules for virtual hosts.      <\/ul>\n<p>Source: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=64380\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.66, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0432\u043d\u0435\u0441\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u0435\u0441\u044f\u0442\u043a\u043e\u0432 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439. \u0423\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (\u043f\u0435\u0440\u0432\u044b\u0435 2 \u0438\u043c\u0435\u044e\u0442 \u0443\u043c\u0435\u0440\u0435\u043d\u043d\u044b\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0430 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u043d\u0438\u0437\u043a\u0438\u0439): CVE-2025-66200 &#8212; \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 CGI-\u0441\u043a\u0440\u0438\u043f\u0442\u0430 \u043f\u043e\u0434 \u0434\u0440\u0443\u0433\u0438\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 \u0441 mod_userdir \u0438 suexec \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u043e\u0439 &#171;RequestHeader&#187; \u0432 \u0444\u0430\u0439\u043b\u0435 .htaccess (\u0435\u0441\u043b\u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043e \u0435\u0451 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 .htaccess). CVE-2025-59775 &#8212; [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-150696","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.66, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0432\u043d\u0435\u0441\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u0435\u0441\u044f\u0442\u043a\u043e\u0432 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/news\/reliz-http-servera-apache-2-4-66-s-ustraneniem-5-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.66 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.66, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0432\u043d\u0435\u0441\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u0435\u0441\u044f\u0442\u043a\u043e\u0432 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/news\/reliz-http-servera-apache-2-4-66-s-ustraneniem-5-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-12-05T15:11:54+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-12-05T15:11:54+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Release of the Apache HTTP Server 2.4.66 addressing 5 vulnerabilities | ProHoster","description":"The release of Apache HTTP Server 2.4.66 has been announced, addressing 5 vulnerabilities and implementing several dozen changes.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/reliz-http-servera-apache-2-4-66-s-ustraneniem-5-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.66 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.66, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0432\u043d\u0435\u0441\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u0435\u0441\u044f\u0442\u043a\u043e\u0432 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/reliz-http-servera-apache-2-4-66-s-ustraneniem-5-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-12-05T15:11:54+00:00","article:modified_time":"2025-12-05T15:11:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"150696","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:15:03","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 16:25:22","updated":"2026-02-09 22:15:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/150696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=150696"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/150696\/revisions"}],"predecessor-version":[{"id":160395,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/150696\/revisions\/160395"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=150696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=150696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=150696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}