Servers and applications
CVE-2021-40438
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 1 Dec 2021.
- Severity
- Critical 9.0
- Published
- 16 Sept 2021
- Last changed
- 6 Aug 2026
- Added to UpHeron
- 17 Oct 2026
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Apache HTTP ServerServers and applications · cpe:a:apache:http_server |
|
Known exploited
- CISA name
- Apache HTTP Server-Side Request Forgery (SSRF)
- Required action
- Apply updates per vendor instructions.
- Due for US agencies
- 15 Dec 2021
- Used in ransomware
- Yes, known