Not rated Exploited

CVE-2024-38475 Apache HTTP Server Improper Escaping of Output Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware campaigns Not observed so far

Weakness CWE-116

Description

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

Affected products and versions

Product	Affected versions	Fixed in
Apache HTTP Server 2.4	2.4.0 → 2.4.59	No fix stated
http_server 2.4	2.4.0 → 2.4.59	No fix stated
ontap_9	Versions not published

References

httpd.apache.org httpd.apache.org
security.netapp.com security.netapp.com

Timeline

Published July 1, 2024
Added to the KEV catalogue May 1, 2025
Last modified November 3, 2025

The 139 CVEs of Apache HTTP Server →

CVE-2026-63686 A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all… Not rated CVE-2026-93546 Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write… Not rated CVE-2026-79768 Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when… Not rated CVE-2026-73637 Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows… Not rated

Track this CVE