What’s Vulnerable › Vulnerabilities

CVE-2024-38473: Apache HTTP Server proxy encoding problem

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 25.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-07-01 · updated 2026-06-17
• Weakness: CWE-116

Description

Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Affected products

• Apache HTTP Server: from 2.4.0 before 2.4.60 — fixed in 2.4.60
• NetApp ONTAP 9: 9

How to fix

Upgrade to a fixed version: Apache HTTP Server 2.4.60. Check the vendor advisory for mitigations.

References

• https://httpd.apache.org/security/vulnerabilities_24.html
• https://security.netapp.com/advisory/ntap-20240712-0001/
• http://www.openwall.com/lists/oss-security/2024/07/01/6
• https://httpd.apache.org/security/vulnerabilities_24.html
• https://security.netapp.com/advisory/ntap-20240712-0001/

Get alerted when CVE-2024-38473 or the next vulnerability affects your stack