Apache · Apache
CVE-2021-40438
Apache HTTP Server-Side Request Forgery (SSRF)
CISA KEV record
- CISA date added
- 2021-12-01
- CISA due date
- 2021-12-15
- Known ransomware use
- Known
NVD risk context
9.0 CRITICAL
CVSS is a technical severity score. CISA’s KEV status remains the evidence that this vulnerability is known to be exploited.
Description
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Required action
Apply updates per vendor instructions.
NVD reference index
Vendor and remediation references
NVD has tagged these sources as vendor advisories, patches, mitigations, or release notes.
- https://httpd.apache.org/security/vulnerabilities_24.html ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/ ↗
- https://www.oracle.com/security-alerts/cpuapr2022.html ↗
- https://www.oracle.com/security-alerts/cpujan2022.html ↗
Other NVD references (15)
- https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf ↗
- https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E ↗
- https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E ↗
- https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E ↗
- https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E ↗
- https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E ↗
- https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E ↗
- https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E ↗
- https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html ↗
- https://security.gentoo.org/glsa/202208-20 ↗
- https://security.netapp.com/advisory/ntap-20211008-0004/ ↗
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ ↗
- https://www.debian.org/security/2021/dsa-4982 ↗
- https://www.tenable.com/security/tns-2021-17 ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40438 ↗
MITRE CWE context
CWE classification
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
View official MITRE CWE details ↗NVD record timing
NVD record timeline
These dates describe NVD’s record, not CISA’s KEV addition or remediation due date.
- NVD published
- Sep 16, 2021, 03:15 PM UTC When NVD first published this CVE record.
- NVD last updated
- Jun 17, 2026, 04:06 AM UTC When NVD last changed its analysis or record data.
Advanced: view the technical CVSS vector
This standardized code is intended for security tools and technical analysts. The plain-language risk summary above explains its main points.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2021-40438