Back to CVE records
Critical 9.0Known exploited (CISA KEV)Published Sep 16, 2021
CVE-2021-40438mod_proxy SSRF
Updated under an hour ago ()
Does this affect you?
It affects Apache Software Foundation Apache HTTP Server and 39 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Dec 1, 2021; federal agencies had to remediate by Dec 15, 2021, and it is known to be used in ransomware. Treat that date as your deadline.
Do this next
Start free and add your stack
Free account, 1 product
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
- CVSS
- 9.0 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-918
- Known exploited
- Added to CISA KEV Dec 1, 2021; federal remediation due Dec 15, 2021; known ransomware useApply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 100.00% (percentile 100)
- Assigned by
- apache
- NVD analysis
- Analyzed
- Record last updated
- Aug 6, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Apache Software Foundation Apache HTTP Server apache_software_foundation:apache_http_server (from the name) | from Apache HTTP Server 2.4 through 2.4.48 | CNA record |
resf rocky_linux resf:rocky_linux | 8.0 | NVD |
redhat enterprise_linux redhat:enterprise_linux | 8.0 | NVD |
redhat enterprise_linux_eus redhat:enterprise_linux_eus | 8.1; 8.2; 8.4; 8.6; 8.8 | NVD |
redhat enterprise_linux_for_arm_64 redhat:enterprise_linux_for_arm_64 | 8.0 | NVD |
redhat enterprise_linux_for_arm_64_eus redhat:enterprise_linux_for_arm_64_eus | 8.6; 8.8 | NVD |
redhat enterprise_linux_for_ibm_z_systems redhat:enterprise_linux_for_ibm_z_systems | 7.0_s390x; 8.0 | NVD |
redhat enterprise_linux_for_ibm_z_systems_eus redhat:enterprise_linux_for_ibm_z_systems_eus | 8.1; 8.4; 8.8 | NVD |
redhat enterprise_linux_for_ibm_z_systems_eus_s390x redhat:enterprise_linux_for_ibm_z_systems_eus_s390x | 8.2 | NVD |
redhat enterprise_linux_for_power_big_endian redhat:enterprise_linux_for_power_big_endian | 7.0 | NVD |
redhat enterprise_linux_for_power_little_endian redhat:enterprise_linux_for_power_little_endian | 7.0; 8.0 | NVD |
redhat enterprise_linux_for_power_little_endian_eus redhat:enterprise_linux_for_power_little_endian_eus | 8.1; 8.2; 8.4; 8.6; 8.8 | NVD |
redhat enterprise_linux_for_scientific_computing redhat:enterprise_linux_for_scientific_computing | 7.0 | NVD |
redhat enterprise_linux_server redhat:enterprise_linux_server | 7.0 | NVD |
redhat enterprise_linux_server_aus redhat:enterprise_linux_server_aus | 7.2; 7.3; 7.4; 7.6; 7.7; 8.2; 8.4; 8.6 | NVD |
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 7.6; 7.7; 8.1; 8.2; 8.4; 8.6; 8.8 | NVD |
redhat enterprise_linux_server_tus redhat:enterprise_linux_server_tus | 7.6; 7.7; 8.2; 8.4; 8.6; 8.8 | NVD |
redhat enterprise_linux_server_update_services_for_sap_solutions redhat:enterprise_linux_server_update_services_for_sap_solutions | 7.6; 7.7 | NVD |
redhat enterprise_linux_update_services_for_sap_solutions redhat:enterprise_linux_update_services_for_sap_solutions | 8.1; 8.2; 8.4; 8.6; 8.8 | NVD |
redhat enterprise_linux_workstation redhat:enterprise_linux_workstation | 7.0 | NVD |
redhat jboss_core_services redhat:jboss_core_services | 1.0 | NVD |
redhat software_collections redhat:software_collections | 1.0 | NVD |
apache http_server apache:http_server | through 2.4.48 | NVD |
fedoraproject fedora fedoraproject:fedora | 34; 35 | NVD |
debian debian_linux debian:debian_linux | 9.0; 10.0; 11.0 | NVD |
netapp cloud_backup netapp:cloud_backup | all versions | NVD |
netapp clustered_data_ontap netapp:clustered_data_ontap | all versions | NVD |
netapp storagegrid netapp:storagegrid | all versions | NVD |
broadcom brocade_fabric_operating_system_firmware broadcom:brocade_fabric_operating_system_firmware | all versions | NVD |
f5 f5os f5:f5os | from 1.1.0 through 1.1.4; from 1.2.0 through 1.2.1 | NVD |
oracle enterprise_manager_ops_center oracle:enterprise_manager_ops_center | 12.4.0.0 | NVD |
oracle http_server oracle:http_server | 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle instantis_enterprisetrack oracle:instantis_enterprisetrack | 17.1; 17.2; 17.3 | NVD |
oracle secure_global_desktop oracle:secure_global_desktop | 5.6 | NVD |
oracle zfs_storage_appliance_kit oracle:zfs_storage_appliance_kit | 8.8 | NVD |
siemens ruggedcom_nms siemens:ruggedcom_nms | all versions | NVD |
siemens sinec_nms siemens:sinec_nms | before 1.0.3 | NVD |
siemens sinema_remote_connect_server siemens:sinema_remote_connect_server | before 3.1; 3.2 | NVD |
siemens sinema_server siemens:sinema_server | 14.0 | NVD |
tenable tenable.sc tenable:tenable.sc | through 5.19.1 | NVD |
References
- https://httpd.apache.org/security/vulnerabilities_24.htmlx-refsource-misc, release-notes, vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/vendor-advisory, x-refsource-fedora, release-notes
- https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/vendor-advisory, x-refsource-fedora, release-notes
- https://lists.debian.org/debian-lts-announce/2021/10/msg00001.htmlmailing-list, x-refsource-mlist, third-party-advisory
- https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3Emailing-list, x-refsource-mlist
- https://www.debian.org/security/2021/dsa-4982vendor-advisory, x-refsource-debian, mailing-list, third-party-advisory
- https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3Emailing-list, x-refsource-mlist
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQvendor-advisory, x-refsource-cisco, broken-link, third-party-advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlx-refsource-misc, patch, third-party-advisory
- https://www.tenable.com/security/tns-2021-17x-refsource-confirm, third-party-advisory
- https://security.netapp.com/advisory/ntap-20211008-0004/x-refsource-confirm, third-party-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlx-refsource-misc, patch, third-party-advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdfx-refsource-confirm, third-party-advisory
- https://security.gentoo.org/glsa/202208-20vendor-advisory, x-refsource-gentoo, third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40438us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.