Non notée Exploitée · rançongiciel

CVE-2021-40438 Apache HTTP Server-Side Request Forgery (SSRF)

Exploitation active constatée

· catalogue CISA KEV

Action attendue Apply updates per vendor instructions.

Campagnes de rançongiciel Utilisation connue

Faiblesse CWE-918

Description

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
Apache HTTP Server 2.4	premières → 2.4.48	Pas de correctif indiqué

Références

httpd.apache.org httpd.apache.org
FEDORA-2021-dce7e7738e lists.fedoraproject.org
[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info lists.apache.org
[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info lists.apache.org
[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info lists.apache.org
[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info lists.apache.org
FEDORA-2021-e3f6dd670d lists.fedoraproject.org
[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update lists.debian.org
[httpd-bugs] 20211008 [Bug 65616] CVE-2021-36160 regression lists.apache.org
DSA-4982 www.debian.org
[httpd-users] 20211019 [users@httpd] Regarding CVE-2021-40438 lists.apache.org
[httpd-users] 20211019 Re: [users@httpd] Regarding CVE-2021-40438 lists.apache.org
20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021 tools.cisco.com
www.oracle.com www.oracle.com
www.tenable.com www.tenable.com
security.netapp.com security.netapp.com
www.oracle.com www.oracle.com
cert-portal.siemens.com cert-portal.siemens.com
GLSA-202208-20 security.gentoo.org

Chronologie

Publiée 16 septembre 2021
Ajoutée au catalogue KEV 1 décembre 2021
Dernière modification 6 août 2026

Les 139 CVE de Apache HTTP Server →

CVE-2026-63686 A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all… Non notée CVE-2026-93546 Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write… Non notée CVE-2026-79768 Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when… Non notée CVE-2026-73637 Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows… Non notée

Suivre cette CVE