Actively exploited in the wild

Apache HTTP Server-Side Request Forgery (SSRF)

Apache - Apache · Listed in the CISA KEV since 2021-12-01. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2021-40438

CriticalCVSS 9.0KEV

Published: 16/09/2021(UTC)Updated: 01/08/2026(UTC)Translated: 01/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

100.00%

100th percentile - higher than 100% of all known CVEs

Summary

A vulnerability in Apache HTTP Server allows a remote attacker to redirect requests via mod_proxy to an origin server of their choice using a crafted URI path. Affects versions 2.4.48 and earlier.

Risk Assessment

An attacker can use the server as a proxy to attack other systems or gain unauthorized access to internal resources.

Recommendation

Immediately update Apache HTTP Server to version 2.4.49 or later.

Original NVD description (English source)

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.