ZeroDay Findings
Sign inSign up

Findings

CVE-2021-40438

Apache HTTP Server-Side Request Forgery (SSRF)

Published Sep 16, 2021 · updated Aug 5, 2026 · resf rocky linux

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 16, 2021 · Catalog

    Detected

    A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

  2. Dec 1, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Dec 15, 2021 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Aug 5, 2026 · Catalog

    Updated

    A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Required action

Apply updates per vendor instructions.

CISA due date Dec 15, 2021

Affected

  • cpe apache/http serverversion unspecified
  • cpe fedoraproject/fedora34
  • cpe redhat/enterprise linux8.0
  • cpe redhat/enterprise linux eus8.1
  • cpe redhat/enterprise linux eus8.2
  • cpe redhat/enterprise linux eus8.4
  • cpe redhat/enterprise linux eus8.6
  • cpe redhat/enterprise linux eus8.8
  • cpe redhat/enterprise linux for arm 648.0
  • cpe redhat/jboss core services1.0
  • cpe redhat/software collections1.0
  • cpe resf/rocky linux8.0
  • vendor Apache Apacheversion unspecified

Sources

  • CISA KEVCVE-2021-40438

    A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

    cisa.gov
  • CVE.orgCVE-2021-40438

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-40438

    30-day exploitation probability 100.0%

    first.org
  • NIST NVDCVE-2021-40438

    A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

    nvd.nist.gov

References