Debian 11 Apache2 Critical Integer Overflow SSRF DLA-4452-1 CVE-2025-55753

CVE-2025-55753

An integer overflow was found in the case of failed ACME certificate
renewal leads, after a number of failures (~30 days in default configurations),
to the backoff timer becoming 0. Attempts to renew the certificate
then are repeated without delays until it succeeds

CVE-2025-58098

Apache with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi)
passes the shell-escaped query string to #exec cmd="..." directives.

CVE-2025-59775

A Server-Side Request Forgery (SSRF) vulnerability was found
in Apache HTTP Server on Windows with AllowEncodedSlashes On
and MergeSlashes Off allows to potentially leak NTLM hashes to
a malicious server via SSRF

CVE-2025-65082

An Improper Neutralization of Escape, Meta, or Control Sequences
vulnerability was found in Apache HTTP Server through environment
variables set via the Apache configuration unexpectedly superseding
variables calculated by the server for CGI programs.

CVE-2025-66200