Vulnerabilities/Apache/CVE-2021-40438

CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF)

CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC

Exploitation confirmedRansomware use knownFix: Unknown

CVSS 3.1 · NVD9.0Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 1 Dec 2021

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Recommended action

Apply updates per vendor instructions.

CISA due date 15 Dec 2021 · CWE-918

Vendor advisory ↗CISA KEV entry ↗

Am I affected?

ProductAffected versionsFixed in
Apache HTTP ServerApache HTTP Server 2.4 to 2.4.48Unknown

No source states a fixed version. Check the vendor advisory below.

Before you patch

Restart

See vendor guidance.

Known issues

Check release notes.

Verification

Confirm installed version.

Timeline

  • 1 Dec 2021 · Added to CISA KEV
  • 15 Dec 2021 · CISA due date

References

Sources checked
CISA KEV30 Oct 2026, 12:10 UTC
CVE List v530 Oct 2026, 12:10 UTC
NVD30 Oct 2026, 12:10 UTC
FIRST EPSS30 Oct 2026, 12:11 UTC

Data from CISA, MITRE, NVD and FIRST. Sources and licences.