What’s Vulnerable › Vulnerabilities
CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF)
- Severity: critical (CVSS 9.0 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2021-12-01
- EPSS: 100.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2021-09-16 · updated 2026-08-06
- Weakness: CWE-918
Description
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Affected products
- Apache HTTP Server: through 2.4.48
- Broadcom Brocade Fabric Operating System Firmware: all versions
- Debian Linux: 9.0, 10.0, 11.0
- F5Os: from 1.1.0 through 1.1.4; from 1.2.0 through 1.2.1
- Fedoraproject Fedora: 34, 35
- NetApp Cloud Backup: all versions
- Clustered Data ONTAP: all versions
- NetApp StorageGRID: all versions
- Oracle Corporation Enterprise Manager Ops Center: 12.4.0.0
- Oracle Corporation Oracle HTTP Server: 12.2.1.3.0, 12.2.1.4.0
- Oracle Instantis Enterprisetrack: 17.1, 17.2, 17.3
- Oracle Corporation Secure Global Desktop: 5.6
- Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8
- Red Hat Enterprise Linux: 8.0
- RedHat Enterprise Linux Eus: 8.1, 8.2, 8.4, 8.6, 8.8
- RedHat Enterprise Linux For Arm 64: 8.0
- RedHat Enterprise Linux For Arm 64 Eus: 8.6, 8.8
- RedHat Enterprise Linux For Ibm Z Systems: 7.0_s390x, 8.0
- RedHat Enterprise Linux For Ibm Z Systems Eus: 8.1, 8.4, 8.8
- RedHat Enterprise Linux For Ibm Z Systems Eus S390X: 8.2
- RedHat Enterprise Linux For Power Big Endian: 7.0
- RedHat Enterprise Linux For Power Little Endian: 7.0, 8.0
- RedHat Enterprise Linux For Power Little Endian Eus: 8.1, 8.2, 8.4, 8.6, 8.8
- RedHat Enterprise Linux For Scientific Computing: 7.0
- RedHat Enterprise Linux Server: 7.0
- RedHat Enterprise Linux Server Aus: 7.2, 7.3, 7.4, 7.6, 7.7, 8.2 (+2)
- RedHat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions: 7.6, 7.7, 8.1, 8.2, 8.4, 8.6 (+1)
- RedHat Enterprise Linux Server Tus: 7.6, 7.7, 8.2, 8.4, 8.6, 8.8
- RedHat Enterprise Linux Server Update Services For Sap Solutions: 7.6, 7.7
- RedHat Enterprise Linux Update Services For Sap Solutions: 8.1, 8.2, 8.4, 8.6, 8.8
How to fix
Upgrade to a fixed version: Siemens SINEC NMS 1.0.3; Siemens SINEMA Remote Connect Server 3.1. Check the vendor advisory for mitigations.
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
Get alerted when CVE-2021-40438 or the next vulnerability affects your stack