CVE-2021-40438
Published 2021-09-16 · Updated 2026-08-06 · Source security@apache.org
Summary
CVE-2021-40438 is a critical-severity (CVSS 9.0) vulnerability in Apache Apache. CISA added it to the Known Exploited Vulnerabilities catalog on December 1, 2021, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by December 15, 2021. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Apache has 41 vulnerabilities in the KEV catalog, 8 of them linked to ransomware.
All 41 known-exploited Apache vulnerabilities →Description
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Apache — Apache
Name: Apache HTTP Server-Side Request Forgery (SSRF)
Date added: 2021-12-01 · Due: 2021-12-15
Required action: Apply updates per vendor instructions.
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E