{"id":"CVE-2021-40438","url":"https://www.cyber-defence.io/tools/cve/CVE-2021-40438","generatedAt":"2026-10-31T14:08:48.352Z","title":"Apache HTTP Server-Side Request Forgery (SSRF)","description":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:08.000Z","lastModified":"2026-08-06T05:16:36.000Z","status":"Analyzed","sourceIdentifier":"security@apache.org","cvss":{"version":"3.1","score":9,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"},"cwe":["CWE-918"],"affected":["resf/rocky linux","redhat/enterprise linux","redhat/enterprise linux eus","redhat/enterprise linux for arm 64","redhat/enterprise linux for arm 64 eus","redhat/enterprise linux for ibm z systems","redhat/enterprise linux for ibm z systems eus","redhat/enterprise linux for ibm z systems eus s390x","redhat/enterprise linux for power big endian","redhat/enterprise linux for power little endian","redhat/enterprise linux for power little endian eus","redhat/enterprise linux for scientific computing","redhat/enterprise linux server","redhat/enterprise linux server aus","redhat/enterprise linux server for power little endian update services for sap solutions","redhat/enterprise linux server tus","redhat/enterprise linux server update services for sap solutions","redhat/enterprise linux update services for sap solutions","redhat/enterprise linux workstation","redhat/jboss core services","redhat/software collections","apache/http server","fedoraproject/fedora","debian/debian linux","netapp/cloud backup","netapp/clustered data ontap","netapp/storagegrid","broadcom/brocade fabric operating system firmware","f5/f5os","oracle/enterprise manager ops center","oracle/http server","oracle/instantis enterprisetrack","oracle/secure global desktop","oracle/zfs storage appliance kit","siemens/ruggedcom nms","siemens/sinec nms","siemens/sinema remote connect server","siemens/sinema server","tenable/tenable.sc"],"epss":{"score":0.99999,"percentile":0.99997,"date":"2026-10-30","history":[]},"kev":{"listed":true,"dateAdded":"2021-12-01","dueDate":"2021-12-15","knownRansomwareCampaignUse":"Known","notes":"Apply updates per vendor instructions.\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-40438"},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 15 December 2021). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["Release Notes","Vendor Advisory"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html","tags":["Mailing List","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/","tags":["Release Notes"],"source":"security@apache.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/","tags":["Release Notes"],"source":"security@apache.org"},{"url":"https://security.gentoo.org/glsa/202208-20","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://security.netapp.com/advisory/ntap-20211008-0004/","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ","tags":["Broken Link","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.debian.org/security/2021/dsa-4982","tags":["Mailing List","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["Patch","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.tenable.com/security/tns-2021-17","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["Release Notes","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/","tags":["Release Notes"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/","tags":["Release Notes"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202208-20","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20211008-0004/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ","tags":["Broken Link","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2021/dsa-4982","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.tenable.com/security/tns-2021-17","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40438","tags":["US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-40438","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}