CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF)

KEVRansomware

Analyzed

AliasesALPINE-CVE-2021-40438RHSA-2021:3746RHSA-2021:3754+6 more

Published 16-09-2021Last modified 06-08-2026

Vulnerability summary

CVE-2021-40438 is a critical (CVSS 9.0) Server-Side Request Forgery vulnerability in Apache. It is known to be exploited: CISA lists it, first on 01-12-2021. It has been used in ransomware campaigns. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities.

Priority

Act nowransomware

Known ransomware use (CISA, 01-12-2021)

Source freshness unavailable

How is this decided?

CVSS score

9.0/10

010

Critical · v3.1 (CVE.org)

EPSS score

100.00%

0%100%

Critical · 0.00 pp in 30 days

KEVExploited in the wildCritical · listed in 1 catalog

RansomwareKnown useFlagged by CISA

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 7

DLA-2776-1 DSA-4982-1 MGASA-2021-0439 OPENSUSE-SU-2021:1438-1 OPENSUSE-SU-2021:3522-1 RHSA-2021:3816+5 more

Timeline

16-09-2021
PublishedVulnerability first disclosed.
01-12-2021
Added to CISA KEVExploitedApache HTTP Server-Side Request Forgery (SSRF)
15-12-2021
CISA remediation dueDeadline passedApply updates per vendor instructions.
06-08-2026
Last modifiedVulnerability information updated.

Description

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

CVSS metrics

7 scores · 6 sources · 2 versions

v3.19.0v2.06.8

EPSS trend

Probability

100.00%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 100.00% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 01-12-2021
Federal due date: 15-12-2021

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2021-40438

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-918Server-Side Request ForgeryThe web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat79 products

enterprise_linux8.0
enterprise_linux_eus8.1 | 8.2 | 8.4 | 8.6 | 8.8
enterprise_linux_for_arm_648.0
enterprise_linux_for_arm_64_eus8.6 | 8.8
enterprise_linux_for_ibm_z_systems7.0_s390x | 8.0

enterprise_linux_for_ibm_z_systems_eus8.1 | 8.4 | 8.8
enterprise_linux_for_ibm_z_systems_eus_s390x8.2
enterprise_linux_for_power_big_endian7.0
enterprise_linux_for_power_little_endian7.0 | 8.0
enterprise_linux_for_power_little_endian_eus8.1 | 8.2 | 8.4 | 8.6 | 8.8
enterprise_linux_for_scientific_computing7.0
enterprise_linux_server7.0
enterprise_linux_server_aus7.2 | 7.3 | 7.4 | 7.6 | 7.7 | 8.2 | 8.4 | 8.6
enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions7.6 | 7.7 | 8.1 | 8.2 | 8.4 | 8.6 | 8.8
enterprise_linux_server_tus7.6 | 7.7 | 8.2 | 8.4 | 8.6 | 8.8
enterprise_linux_server_update_services_for_sap_solutions7.6 | 7.7
enterprise_linux_update_services_for_sap_solutions8.1 | 8.2 | 8.4 | 8.6 | 8.8
enterprise_linux_workstation7.0
jboss_core_services1.0
software_collections1.0
httpd< 0:2.4.37-21.module+el8.2.0+12904+53ee7aba.1 | < 0:2.4.37-16.module+el8.1.0+12900+7e6e5641.1 | < 0:2.4.6-97.el7_9.1 | < 0:2.4.6-40.el7_2.7 | < 0:2.4.6-45.el7_3.6 | < 0:2.4.6-67.el7_4.7 | < 0:2.4.6-89.el7_6.2 | < 0:2.4.6-90.el7_7.1
httpd-debuginfo< 0:2.4.37-21.module+el8.2.0+12904+53ee7aba.1 | < 0:2.4.37-16.module+el8.1.0+12900+7e6e5641.1 | < 0:2.4.6-97.el7_9.1 | < 0:2.4.6-40.el7_2.7 | < 0:2.4.6-45.el7_3.6 | < 0:2.4.6-67.el7_4.7 | < 0:2.4.6-89.el7_6.2 | < 0:2.4.6-90.el7_7.1
httpd-debugsource< 0:2.4.37-21.module+el8.2.0+12904+53ee7aba.1 | < 0:2.4.37-16.module+el8.1.0+12900+7e6e5641.1
httpd-devel< 0:2.4.37-21.module+el8.2.0+12904+53ee7aba.1 | < 0:2.4.37-16.module+el8.1.0+12900+7e6e5641.1 | < 0:2.4.6-97.el7_9.1 | < 0:2.4.6-40.el7_2.7 | < 0:2.4.6-45.el7_3.6 | < 0:2.4.6-67.el7_4.7 | < 0:2.4.6-89.el7_6.2 | < 0:2.4.6-90.el7_7.1
httpd-filesystem< 0:2.4.37-21.module+el8.2.0+12904+53ee7aba.1 | < 0:2.4.37-16.module+el8.1.0+12900+7e6e5641.1
httpd-manual< 0:2.4.37-21.module+el8.2.0+12904+53ee7aba.1 | < 0:2.4.37-16.module+el8.1.0+12900+7e6e5641.1 | < 0:2.4.6-97.el7_9.1 | < 0:2.4.6-40.el7_2.7 | < 0:2.4.6-45.el7_3.6 | < 0:2.4.6-67.el7_4.7 | < 0:2.4.6-89.el7_6.2 | < 0:2.4.6-90.el7_7.1
httpd-tools< 0:2.4.37-21.module+el8.2.0+12904+53ee7aba.1 | < 0:2.4.37-16.module+el8.1.0+12900+7e6e5641.1 | < 0:2.4.6-97.el7_9.1 | < 0:2.4.6-40.el7_2.7 | < 0:2.4.6-45.el7_3.6 | < 0:2.4.6-67.el7_4.7 | < 0:2.4.6-89.el7_6.2 | < 0:2.4.6-90.el7_7.1
httpd-tools-debuginfo< 0:2.4.37-21.module+el8.2.0+12904+53ee7aba.1 | < 0:2.4.37-16.module+el8.1.0+12900+7e6e5641.1
httpd24-httpd< 0:2.4.34-22.el7.1
httpd24-httpd-debuginfo< 0:2.4.34-22.el7.1
httpd24-httpd-devel< 0:2.4.34-22.el7.1
httpd24-httpd-manual< 0:2.4.34-22.el7.1
httpd24-httpd-tools< 0:2.4.34-22.el7.1
httpd24-mod_ldap< 0:2.4.34-22.el7.1
httpd24-mod_proxy_html< 1:2.4.34-22.el7.1
httpd24-mod_session< 0:2.4.34-22.el7.1
httpd24-mod_ssl< 1:2.4.34-22.el7.1
jbcs-httpd24-httpd< 0:2.4.37-76.jbcs.el7 | < 0:2.4.37-76.el8jbcs
jbcs-httpd24-httpd-debuginfo< 0:2.4.37-76.jbcs.el7 | < 0:2.4.37-76.el8jbcs
jbcs-httpd24-httpd-devel< 0:2.4.37-76.jbcs.el7 | < 0:2.4.37-76.el8jbcs
jbcs-httpd24-httpd-manual< 0:2.4.37-76.jbcs.el7 | < 0:2.4.37-76.el8jbcs
jbcs-httpd24-httpd-selinux< 0:2.4.37-76.jbcs.el7 | < 0:2.4.37-76.el8jbcs
jbcs-httpd24-httpd-tools< 0:2.4.37-76.jbcs.el7 | < 0:2.4.37-76.el8jbcs
jbcs-httpd24-httpd-tools-debuginfo< 0:2.4.37-76.el8jbcs
jbcs-httpd24-mod_cluster-native< 0:1.3.16-7.Final_redhat_2.jbcs.el7 | < 0:1.3.16-7.Final_redhat_2.el8jbcs
jbcs-httpd24-mod_cluster-native-debuginfo< 0:1.3.16-7.Final_redhat_2.jbcs.el7 | < 0:1.3.16-7.Final_redhat_2.el8jbcs
jbcs-httpd24-mod_http2< 0:1.15.7-19.jbcs.el7 | < 0:1.15.7-19.el8jbcs
jbcs-httpd24-mod_http2-debuginfo< 0:1.15.7-19.jbcs.el7 | < 0:1.15.7-19.el8jbcs
jbcs-httpd24-mod_jk< 0:1.2.48-18.redhat_1.jbcs.el7 | < 0:1.2.48-18.redhat_1.el8jbcs
jbcs-httpd24-mod_jk-ap24< 0:1.2.48-18.redhat_1.jbcs.el7 | < 0:1.2.48-18.redhat_1.el8jbcs
jbcs-httpd24-mod_jk-ap24-debuginfo< 0:1.2.48-18.redhat_1.el8jbcs
jbcs-httpd24-mod_jk-debuginfo< 0:1.2.48-18.redhat_1.jbcs.el7
jbcs-httpd24-mod_jk-manual< 0:1.2.48-18.redhat_1.jbcs.el7 | < 0:1.2.48-18.redhat_1.el8jbcs
jbcs-httpd24-mod_ldap< 0:2.4.37-76.jbcs.el7 | < 0:2.4.37-76.el8jbcs
jbcs-httpd24-mod_ldap-debuginfo< 0:2.4.37-76.el8jbcs
jbcs-httpd24-mod_md< 1:2.0.8-38.jbcs.el7 | < 1:2.0.8-38.el8jbcs
jbcs-httpd24-mod_md-debuginfo< 1:2.0.8-38.jbcs.el7 | < 1:2.0.8-38.el8jbcs
jbcs-httpd24-mod_proxy_html< 1:2.4.37-76.jbcs.el7 | < 1:2.4.37-76.el8jbcs
jbcs-httpd24-mod_proxy_html-debuginfo< 1:2.4.37-76.el8jbcs
jbcs-httpd24-mod_security< 0:2.9.2-65.GA.jbcs.el7 | < 0:2.9.2-65.GA.el8jbcs
jbcs-httpd24-mod_security-debuginfo< 0:2.9.2-65.GA.jbcs.el7 | < 0:2.9.2-65.GA.el8jbcs
jbcs-httpd24-mod_session< 0:2.4.37-76.jbcs.el7 | < 0:2.4.37-76.el8jbcs
jbcs-httpd24-mod_session-debuginfo< 0:2.4.37-76.el8jbcs
jbcs-httpd24-mod_ssl< 1:2.4.37-76.jbcs.el7 | < 1:2.4.37-76.el8jbcs
jbcs-httpd24-mod_ssl-debuginfo< 1:2.4.37-76.el8jbcs
mod_http2< 0:1.11.3-3.module+el8.2.0+7758+84b4ca3e.1 | < 0:1.11.3-3.module+el8.1.0+7763+babdfe5b.1
mod_http2-debuginfo< 0:1.11.3-3.module+el8.2.0+7758+84b4ca3e.1 | < 0:1.11.3-3.module+el8.1.0+7763+babdfe5b.1
mod_http2-debugsource< 0:1.11.3-3.module+el8.2.0+7758+84b4ca3e.1 | < 0:1.11.3-3.module+el8.1.0+7763+babdfe5b.1
mod_ldap< 0:2.4.37-21.module+el8.2.0+12904+53ee7aba.1 | < 0:2.4.37-16.module+el8.1.0+12900+7e6e5641.1 | < 0:2.4.6-97.el7_9.1 | < 0:2.4.6-40.el7_2.7 | < 0:2.4.6-45.el7_3.6 | < 0:2.4.6-67.el7_4.7 | < 0:2.4.6-89.el7_6.2 | < 0:2.4.6-90.el7_7.1
mod_ldap-debuginfo< 0:2.4.37-21.module+el8.2.0+12904+53ee7aba.1 | < 0:2.4.37-16.module+el8.1.0+12900+7e6e5641.1
mod_md< 1:2.0.8-7.module+el8.2.0+5531+7e4d69a2 | < 0:2.4.37-16.module+el8.1.0+12900+7e6e5641.1
mod_md-debuginfo< 1:2.0.8-7.module+el8.2.0+5531+7e4d69a2 | < 0:2.4.37-16.module+el8.1.0+12900+7e6e5641.1
mod_md-debugsource< 1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
mod_proxy_html< 1:2.4.37-21.module+el8.2.0+12904+53ee7aba.1 | < 1:2.4.37-16.module+el8.1.0+12900+7e6e5641.1 | < 1:2.4.6-97.el7_9.1 | < 1:2.4.6-40.el7_2.7 | < 1:2.4.6-45.el7_3.6 | < 1:2.4.6-67.el7_4.7 | < 1:2.4.6-89.el7_6.2 | < 1:2.4.6-90.el7_7.1
mod_proxy_html-debuginfo< 1:2.4.37-21.module+el8.2.0+12904+53ee7aba.1 | < 1:2.4.37-16.module+el8.1.0+12900+7e6e5641.1
mod_session< 0:2.4.37-21.module+el8.2.0+12904+53ee7aba.1 | < 0:2.4.37-16.module+el8.1.0+12900+7e6e5641.1 | < 0:2.4.6-97.el7_9.1 | < 0:2.4.6-67.el7_4.7 | < 0:2.4.6-89.el7_6.2 | < 0:2.4.6-90.el7_7.1 | < 0:2.4.6-40.el7_2.7 | < 0:2.4.6-45.el7_3.6
mod_session-debuginfo< 0:2.4.37-21.module+el8.2.0+12904+53ee7aba.1 | < 0:2.4.37-16.module+el8.1.0+12900+7e6e5641.1
mod_ssl< 1:2.4.37-21.module+el8.2.0+12904+53ee7aba.1 | < 1:2.4.37-16.module+el8.1.0+12900+7e6e5641.1 | < 1:2.4.6-97.el7_9.1 | < 1:2.4.6-40.el7_2.7 | < 1:2.4.6-45.el7_3.6 | < 1:2.4.6-67.el7_4.7 | < 1:2.4.6-89.el7_6.2 | < 1:2.4.6-90.el7_7.1
mod_ssl-debuginfo< 1:2.4.37-21.module+el8.2.0+12904+53ee7aba.1 | < 1:2.4.37-16.module+el8.1.0+12900+7e6e5641.1