CVE-2021-40438VulnerabilityPublished 12/01/2021Updated 10/24/2026

CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF)

Affects Apache ApacheSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 12/01/2021
KEV deadline: 12/15/2021
Ransomware: Used in ransomware campaigns
EPSS: 100.0% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-40438 (opens in a new tab)

Affected software

Product	Affected	Fixed in
Apache Apache	Affected <=2.4.48	Fixed in–

Description

CVE-2021-40438 is a Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server's mod_proxy module. A crafted request URI path can cause mod_proxy to forward the request to an origin server chosen by the remote user. This affects Apache HTTP Server versions 2.4.48 and earlier. The vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.

Summary

This vulnerability allows an attacker to manipulate the URI path in a request to cause Apache HTTP Server's mod_proxy to forward the request to an arbitrary origin server specified by the attacker. This SSRF flaw affects Apache HTTP Server versions up to and including 2.4.48. The issue enables attackers to potentially access internal systems or services that are otherwise inaccessible, leveraging the server as a proxy. The vulnerability has been observed in active exploitation scenarios.

Impact

Successful exploitation can allow an attacker to make the server send requests to arbitrary internal or external systems, potentially exposing sensitive information or enabling further attacks within the network. The vulnerability has been exploited in the wild and has been associated with ransomware campaigns, indicating a significant real-world impact.

Mitigation

A fix is available for this vulnerability. Users should upgrade Apache HTTP Server to a version later than 2.4.48 where this issue is resolved. Since this is not a cloud service, remediation depends on applying the official patch or upgrade provided by Apache.

Weaknesses

CWE-918Server-Side Request Forgery (SSRF) (opens in a new tab)

What to do

Affected software

Description

AnalysisAI-generated, updated 10/24/2026, 09:55:31 UTC

Weaknesses

References

Related threats