Not rated Exploited · ransomware

CVE-2021-40438 Apache HTTP Server-Side Request Forgery (SSRF)

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Known to be used

Weakness CWE-918

Description

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Affected products and versions

Product	Affected versions	Fixed in
Apache HTTP Server 2.4	earliest → 2.4.48	No fix stated

References

httpd.apache.org httpd.apache.org
FEDORA-2021-dce7e7738e lists.fedoraproject.org
[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info lists.apache.org
[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info lists.apache.org
[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info lists.apache.org
[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info lists.apache.org
FEDORA-2021-e3f6dd670d lists.fedoraproject.org
[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update lists.debian.org
[httpd-bugs] 20211008 [Bug 65616] CVE-2021-36160 regression lists.apache.org
DSA-4982 www.debian.org
[httpd-users] 20211019 [users@httpd] Regarding CVE-2021-40438 lists.apache.org
[httpd-users] 20211019 Re: [users@httpd] Regarding CVE-2021-40438 lists.apache.org
20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021 tools.cisco.com
www.oracle.com www.oracle.com
www.tenable.com www.tenable.com
security.netapp.com security.netapp.com
www.oracle.com www.oracle.com
cert-portal.siemens.com cert-portal.siemens.com
GLSA-202208-20 security.gentoo.org

Timeline

Published September 16, 2021
Added to the KEV catalogue December 1, 2021
Last modified August 6, 2026

The 139 CVEs of Apache HTTP Server →

CVE-2026-63686 A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all… Not rated CVE-2026-93546 Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write… Not rated CVE-2026-79768 Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when… Not rated CVE-2026-73637 Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows… Not rated

Track this CVE