Apache HTTP Server: Improper privilege management in mod_ssl SSLRequire
Summary
The mod_ssl module of Apache HTTP Server 2.4.0 through 2.4.68 does not properly enforce privileges for SSLRequire expressions with file-related functions. An attacker who can write .htaccess files in a directory where SSLRequire overrides are enabled can use these expressions to read files with the permissions of the httpd process, which may expose sensitive information. The NVD rates the flaw 9.8 (critical), but Apache rates it low and the exposure is limited to this specific configuration.
Affected
- Apache HTTP Server 2.4.0 through 2.4.68
- Default configuration: unaffected
- Affected only where SSLRequire can be used in .htaccess files (AllowOverride)
Fixed in
- Apache HTTP Server 2.4.69 (fixed in 2.4.x by revision r1938672)
- Distribution packages: unknown, verify with the vendor (Debian bookworm and trixie still listed as vulnerable in the tracker)
Workaround
- Prevent untrusted users from using SSLRequire in .htaccess files
- Where directory-level overrides are not needed, disable them in the trusted server configuration for each affected directory
- Move required .htaccess settings into the server configuration first, then validate the configuration and reload Apache
Exploitation
- No known exploitation in the wild; not listed as actively exploited in the sources checked
- No public proof of concept known
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total
- EPSS 0.0052 at the time of the Vulners record
Our recommendation
- Upgrade to Apache HTTP Server 2.4.69 in the normal patch cycle; the release also fixes 19 other CVEs
- Until patched, restrict AllowOverride on directories that do not need it and do not allow untrusted users to write .htaccess files
- Check whether your servers use SSLRequire in .htaccess files
- Check distribution packages for backported fixes before relying on them
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache HTTP Server 2.4 vulnerabilities httpd.apache.org
- oss-security post CVE-2026-59797 www.openwall.com
- Red Hat CVE page CVE-2026-59797 access.redhat.com
- Debian security tracker CVE-2026-59797 security-tracker.debian.org
- CCB Belgium advisory (secondary) ccb.belgium.be
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:35.
Original description (NVD)
Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.