Critical 9.0Known exploited (CISA KEV)Published Sep 16, 2021

CVE-2021-40438mod_proxy SSRF

Updated under an hour ago (Oct 26, 2026, 3:00 PM ET)

Does this affect you?

It affects Apache Software Foundation Apache HTTP Server and 39 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Dec 1, 2021; federal agencies had to remediate by Dec 15, 2021, and it is known to be used in ransomware. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Apache Software Foundation Apache HTTP Server

Exploited in the last 30 days

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

CVSS: 9.0 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-918
Known exploited: Added to CISA KEV Dec 1, 2021; federal remediation due Dec 15, 2021; known ransomware useApply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 100.00% (percentile 100)
Assigned by: apache
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Apache Software Foundation Apache HTTP Server apache_software_foundation:apache_http_server (from the name)	from Apache HTTP Server 2.4 through 2.4.48	CNA record
resf rocky_linux resf:rocky_linux	8.0	NVD
redhat enterprise_linux redhat:enterprise_linux	8.0	NVD
redhat enterprise_linux_eus redhat:enterprise_linux_eus	8.1; 8.2; 8.4; 8.6; 8.8	NVD
redhat enterprise_linux_for_arm_64 redhat:enterprise_linux_for_arm_64	8.0	NVD
redhat enterprise_linux_for_arm_64_eus redhat:enterprise_linux_for_arm_64_eus	8.6; 8.8	NVD
redhat enterprise_linux_for_ibm_z_systems redhat:enterprise_linux_for_ibm_z_systems	7.0_s390x; 8.0	NVD
redhat enterprise_linux_for_ibm_z_systems_eus redhat:enterprise_linux_for_ibm_z_systems_eus	8.1; 8.4; 8.8	NVD
redhat enterprise_linux_for_ibm_z_systems_eus_s390x redhat:enterprise_linux_for_ibm_z_systems_eus_s390x	8.2	NVD
redhat enterprise_linux_for_power_big_endian redhat:enterprise_linux_for_power_big_endian	7.0	NVD
1–10 of 40

References

References

https://httpd.apache.org/security/vulnerabilities_24.html	x-refsource-misc, release-notes, vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/	vendor-advisory, x-refsource-fedora, release-notes
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E	mailing-list, x-refsource-mlist
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E	mailing-list, x-refsource-mlist
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E	mailing-list, x-refsource-mlist
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E	mailing-list, x-refsource-mlist
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/	vendor-advisory, x-refsource-fedora, release-notes
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html	mailing-list, x-refsource-mlist, third-party-advisory
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E	mailing-list, x-refsource-mlist
https://www.debian.org/security/2021/dsa-4982	vendor-advisory, x-refsource-debian, mailing-list, third-party-advisory
1–10 of 20

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.