CVE-2024-38476: apache software foundation apache http server

CVSS: 9.8v3.1CriticalModified

AliasesALPINE-CVE-2024-38476SUSE-SU-2024:2560-1RHSA-2024:5138+11 more

Published 01-07-2024Last modified 03-11-2025

Vulnerability summary

CVE-2024-38476 is a critical (CVSS 9.8) vulnerability in apache software foundation apache http server. EPSS estimates a 41.61% chance of exploitation in the next 30 days, higher than 98.6% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (CVE.org)

EPSS score

41.61%

0%100%

High · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 9

DSA-5729-1 MGASA-2024-0258 OPENSUSE-SU-2024:14116-1 RHSA-2024:5239 SUSE-SU-2024:2591-1 SUSE-SU-2024:2597-1+6 more

Timeline

01-07-2024
PublishedVulnerability first disclosed.
03-11-2025
Last modifiedVulnerability information updated.

Description

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

CVSS metrics

6 scores · 6 sources · 1 version

v3.19.8

EPSS trend

Probability

41.61%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 41.61% on 18-09-2026

18-09-202618-10-2026

EPSS score

41.61%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-829Inclusion of Functionality from Untrusted Control SphereThe product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Affected systems

Redhat26 products

httpd< 0:2.4.57-11.el9_4.1 | < 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 | < 0:2.4.53-11.el9_2.11 | < 0:2.4.51-7.el9_0.8 | < 0:2.4.37-56.module+el8.8.0+22230+712d65df.9 | < 0:2.4.37-39.module+el8.4.0+22233+7f67fd1f.9 | < 0:2.4.37-47.module+el8.6.0+22231+3e699de3.10 | < 0:2.4.37-21.module+el8.2.0+22234+cf633926.9 | < 0:2.4.6-90.el7_7.5 | < 0:2.4.6-99.el7_9.3
httpd-core< 0:2.4.57-11.el9_4.1 | < 0:2.4.53-11.el9_2.11
httpd-core-debuginfo< 0:2.4.57-11.el9_4.1 | < 0:2.4.53-11.el9_2.11
httpd-debuginfo< 0:2.4.57-11.el9_4.1 | < 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 | < 0:2.4.53-11.el9_2.11 | < 0:2.4.51-7.el9_0.8 | < 0:2.4.37-56.module+el8.8.0+22230+712d65df.9 | < 0:2.4.37-39.module+el8.4.0+22233+7f67fd1f.9 | < 0:2.4.37-47.module+el8.6.0+22231+3e699de3.10 | < 0:2.4.37-21.module+el8.2.0+22234+cf633926.9 | < 0:2.4.6-90.el7_7.5 | < 0:2.4.6-99.el7_9.3
httpd-debugsource< 0:2.4.57-11.el9_4.1 | < 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 | < 0:2.4.53-11.el9_2.11 | < 0:2.4.51-7.el9_0.8 | < 0:2.4.37-56.module+el8.8.0+22230+712d65df.9 | < 0:2.4.37-39.module+el8.4.0+22233+7f67fd1f.9 | < 0:2.4.37-47.module+el8.6.0+22231+3e699de3.10 | < 0:2.4.37-21.module+el8.2.0+22234+cf633926.9

httpd-devel< 0:2.4.57-11.el9_4.1 | < 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 | < 0:2.4.53-11.el9_2.11 | < 0:2.4.51-7.el9_0.8 | < 0:2.4.37-56.module+el8.8.0+22230+712d65df.9 | < 0:2.4.37-39.module+el8.4.0+22233+7f67fd1f.9 | < 0:2.4.37-47.module+el8.6.0+22231+3e699de3.10 | < 0:2.4.37-21.module+el8.2.0+22234+cf633926.9 | < 0:2.4.6-90.el7_7.5 | < 0:2.4.6-99.el7_9.3
httpd-filesystem< 0:2.4.57-11.el9_4.1 | < 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 | < 0:2.4.53-11.el9_2.11 | < 0:2.4.51-7.el9_0.8 | < 0:2.4.37-56.module+el8.8.0+22230+712d65df.9 | < 0:2.4.37-39.module+el8.4.0+22233+7f67fd1f.9 | < 0:2.4.37-47.module+el8.6.0+22231+3e699de3.10 | < 0:2.4.37-21.module+el8.2.0+22234+cf633926.9
httpd-manual< 0:2.4.57-11.el9_4.1 | < 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 | < 0:2.4.53-11.el9_2.11 | < 0:2.4.51-7.el9_0.8 | < 0:2.4.37-56.module+el8.8.0+22230+712d65df.9 | < 0:2.4.37-39.module+el8.4.0+22233+7f67fd1f.9 | < 0:2.4.37-47.module+el8.6.0+22231+3e699de3.10 | < 0:2.4.37-21.module+el8.2.0+22234+cf633926.9 | < 0:2.4.6-90.el7_7.5 | < 0:2.4.6-99.el7_9.3
httpd-tools< 0:2.4.57-11.el9_4.1 | < 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 | < 0:2.4.53-11.el9_2.11 | < 0:2.4.51-7.el9_0.8 | < 0:2.4.37-56.module+el8.8.0+22230+712d65df.9 | < 0:2.4.37-39.module+el8.4.0+22233+7f67fd1f.9 | < 0:2.4.37-47.module+el8.6.0+22231+3e699de3.10 | < 0:2.4.37-21.module+el8.2.0+22234+cf633926.9 | < 0:2.4.6-90.el7_7.5 | < 0:2.4.6-99.el7_9.3
httpd-tools-debuginfo< 0:2.4.57-11.el9_4.1 | < 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 | < 0:2.4.53-11.el9_2.11 | < 0:2.4.51-7.el9_0.8 | < 0:2.4.37-56.module+el8.8.0+22230+712d65df.9 | < 0:2.4.37-39.module+el8.4.0+22233+7f67fd1f.9 | < 0:2.4.37-47.module+el8.6.0+22231+3e699de3.10 | < 0:2.4.37-21.module+el8.2.0+22234+cf633926.9
mod_http2< 0:1.15.7-10.module+el8.10.0+21653+eaff63f0 | < 0:1.15.7-8.module+el8.8.0+21773+20528f83.5 | < 0:1.15.7-3.module+el8.4.0+21747+916a74df.3 | < 0:1.15.7-5.module+el8.6.0+21746+f601aac0.3 | < 0:1.11.3-3.module+el8.2.0+22123+cf5a147c.4
mod_http2-debuginfo< 0:1.15.7-10.module+el8.10.0+21653+eaff63f0 | < 0:1.15.7-8.module+el8.8.0+21773+20528f83.5 | < 0:1.15.7-3.module+el8.4.0+21747+916a74df.3 | < 0:1.15.7-5.module+el8.6.0+21746+f601aac0.3 | < 0:1.11.3-3.module+el8.2.0+22123+cf5a147c.4
mod_http2-debugsource< 0:1.15.7-10.module+el8.10.0+21653+eaff63f0 | < 0:1.15.7-8.module+el8.8.0+21773+20528f83.5 | < 0:1.15.7-3.module+el8.4.0+21747+916a74df.3 | < 0:1.15.7-5.module+el8.6.0+21746+f601aac0.3 | < 0:1.11.3-3.module+el8.2.0+22123+cf5a147c.4
mod_ldap< 0:2.4.57-11.el9_4.1 | < 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 | < 0:2.4.53-11.el9_2.11 | < 0:2.4.51-7.el9_0.8 | < 0:2.4.37-56.module+el8.8.0+22230+712d65df.9 | < 0:2.4.37-39.module+el8.4.0+22233+7f67fd1f.9 | < 0:2.4.37-47.module+el8.6.0+22231+3e699de3.10 | < 0:2.4.37-21.module+el8.2.0+22234+cf633926.9 | < 0:2.4.6-90.el7_7.5 | < 0:2.4.6-99.el7_9.3
mod_ldap-debuginfo< 0:2.4.57-11.el9_4.1 | < 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 | < 0:2.4.53-11.el9_2.11 | < 0:2.4.51-7.el9_0.8 | < 0:2.4.37-56.module+el8.8.0+22230+712d65df.9 | < 0:2.4.37-39.module+el8.4.0+22233+7f67fd1f.9 | < 0:2.4.37-47.module+el8.6.0+22231+3e699de3.10 | < 0:2.4.37-21.module+el8.2.0+22234+cf633926.9
mod_lua< 0:2.4.57-11.el9_4.1 | < 0:2.4.53-11.el9_2.11 | < 0:2.4.51-7.el9_0.8
mod_lua-debuginfo< 0:2.4.57-11.el9_4.1 | < 0:2.4.53-11.el9_2.11 | < 0:2.4.51-7.el9_0.8
mod_md< 1:2.0.8-8.module+el8.9.0+19080+567b90f8 | < 1:2.0.8-8.module+el8.3.0+6814+67d1e611 | < 1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
mod_md-debuginfo< 1:2.0.8-8.module+el8.9.0+19080+567b90f8 | < 1:2.0.8-8.module+el8.3.0+6814+67d1e611 | < 1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
mod_md-debugsource< 1:2.0.8-8.module+el8.9.0+19080+567b90f8 | < 1:2.0.8-8.module+el8.3.0+6814+67d1e611 | < 1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
mod_proxy_html< 1:2.4.57-11.el9_4.1 | < 1:2.4.37-65.module+el8.10.0+22196+d82931da.2 | < 1:2.4.53-11.el9_2.11 | < 1:2.4.51-7.el9_0.8 | < 1:2.4.37-56.module+el8.8.0+22230+712d65df.9 | < 1:2.4.37-39.module+el8.4.0+22233+7f67fd1f.9 | < 1:2.4.37-47.module+el8.6.0+22231+3e699de3.10 | < 1:2.4.37-21.module+el8.2.0+22234+cf633926.9 | < 1:2.4.6-90.el7_7.5 | < 1:2.4.6-99.el7_9.3
mod_proxy_html-debuginfo< 1:2.4.57-11.el9_4.1 | < 1:2.4.37-65.module+el8.10.0+22196+d82931da.2 | < 1:2.4.53-11.el9_2.11 | < 1:2.4.51-7.el9_0.8 | < 1:2.4.37-56.module+el8.8.0+22230+712d65df.9 | < 1:2.4.37-39.module+el8.4.0+22233+7f67fd1f.9 | < 1:2.4.37-47.module+el8.6.0+22231+3e699de3.10 | < 1:2.4.37-21.module+el8.2.0+22234+cf633926.9
mod_session< 0:2.4.57-11.el9_4.1 | < 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 | < 0:2.4.53-11.el9_2.11 | < 0:2.4.51-7.el9_0.8 | < 0:2.4.37-56.module+el8.8.0+22230+712d65df.9 | < 0:2.4.37-39.module+el8.4.0+22233+7f67fd1f.9 | < 0:2.4.37-47.module+el8.6.0+22231+3e699de3.10 | < 0:2.4.37-21.module+el8.2.0+22234+cf633926.9 | < 0:2.4.6-90.el7_7.5 | < 0:2.4.6-99.el7_9.3
mod_session-debuginfo< 0:2.4.57-11.el9_4.1 | < 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 | < 0:2.4.53-11.el9_2.11 | < 0:2.4.51-7.el9_0.8 | < 0:2.4.37-56.module+el8.8.0+22230+712d65df.9 | < 0:2.4.37-39.module+el8.4.0+22233+7f67fd1f.9 | < 0:2.4.37-47.module+el8.6.0+22231+3e699de3.10 | < 0:2.4.37-21.module+el8.2.0+22234+cf633926.9
mod_ssl< 1:2.4.57-11.el9_4.1 | < 1:2.4.37-65.module+el8.10.0+22196+d82931da.2 | < 1:2.4.53-11.el9_2.11 | < 1:2.4.51-7.el9_0.8 | < 1:2.4.37-56.module+el8.8.0+22230+712d65df.9 | < 1:2.4.37-39.module+el8.4.0+22233+7f67fd1f.9 | < 1:2.4.37-47.module+el8.6.0+22231+3e699de3.10 | < 1:2.4.37-21.module+el8.2.0+22234+cf633926.9 | < 1:2.4.6-90.el7_7.5 | < 1:2.4.6-99.el7_9.3
mod_ssl-debuginfo< 1:2.4.57-11.el9_4.1 | < 1:2.4.37-65.module+el8.10.0+22196+d82931da.2 | < 1:2.4.53-11.el9_2.11 | < 1:2.4.51-7.el9_0.8 | < 1:2.4.37-56.module+el8.8.0+22230+712d65df.9 | < 1:2.4.37-39.module+el8.4.0+22233+7f67fd1f.9 | < 1:2.4.37-47.module+el8.6.0+22231+3e699de3.10 | < 1:2.4.37-21.module+el8.2.0+22234+cf633926.9

Show all 26

Suse6 products

apache2-tls13&distro=SUSE Linux Enterprise Server 12 SP5< 2.4.51-35.54.1
apache2-tls13&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 2.4.51-35.54.1
apache2-tls13&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 2.4.51-35.54.1
apache2&distro=SUSE Linux Enterprise Server 12 SP5< 2.4.51-35.54.1
apache2&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 2.4.51-35.54.1

Show all 6

Alpine1 product

apache2< 2.4.60-r0

Apache1 product

http_server≥ 2.4.0, < 2.4.60

Apache software foundation1 product

apache http server≥ 2.4.0, ≤ 2.4.59

Debian1 product

apache2< 2.4.61-1~deb12u1 | < 2.4.60-1

Netapp1 product

clustered_data_ontap9.0

Ubuntu1 product

apache2< 2.4.7-1ubuntu4.22+esm12 | < 2.4.18-2ubuntu3.17+esm13 | < 2.4.29-1ubuntu4.27+esm3 | < 2.4.41-4ubuntu3.19 | < 2.4.52-1ubuntu4.10 | < 2.4.58-1ubuntu8.2

8 vendors · 38 products