CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF)

Critical severity, CVSS 9.0. Actively exploited: in CISA KEV since 2021-12-01. EPSS: 100% chance of exploitation in the next 30 days.

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Affected products

  • Apache HTTP Server: up to and including 2.4.48
  • Broadcom Brocade Fabric Operating System Firmware: affected versions not specified
  • Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
  • F5 f5os: from 1.1.0, up to and including 1.1.4; from 1.2.0, up to and including 1.2.1
  • Fedoraproject Fedora: version 34 only; version 35 only
  • Netapp Cloud Backup: affected versions not specified
  • Netapp Clustered Data Ontap: affected versions not specified
  • Netapp Storagegrid: affected versions not specified
  • Oracle Enterprise Manager Ops Center: version 12.4.0.0 only
  • Oracle HTTP Server: version 12.2.1.3.0 only; version 12.2.1.4.0 only
  • Oracle Instantis Enterprisetrack: version 17.1 only; version 17.2 only; version 17.3 only
  • Oracle Secure Global Desktop: version 5.6 only
  • Oracle ZFS Storage Appliance Kit: version 8.8 only
  • Red Hat Enterprise Linux: version 8.0 only
  • Red Hat Enterprise Linux Eus: version 8.1 only; version 8.2 only; version 8.4 only; version 8.6 only; version 8.8 only
  • Red Hat Enterprise Linux For Arm 64: version 8.0 only
  • Red Hat Enterprise Linux For Arm 64 Eus: version 8.6 only; version 8.8 only
  • Red Hat Enterprise Linux For IBM Z Systems: version 7.0_s390x only; version 8.0 only
  • Red Hat Enterprise Linux For IBM Z Systems Eus: version 8.1 only; version 8.4 only; version 8.8 only
  • Red Hat Enterprise Linux For IBM Z Systems Eus s390x: version 8.2 only
  • Red Hat Enterprise Linux For Power Big Endian: version 7.0 only
  • Red Hat Enterprise Linux For Power Little Endian: version 7.0 only; version 8.0 only
  • Red Hat Enterprise Linux For Power Little Endian Eus: version 8.1 only; version 8.2 only; version 8.4 only; version 8.6 only; version 8.8 only
  • Red Hat Enterprise Linux For Scientific Computing: version 7.0 only
  • Red Hat Enterprise Linux Server: version 7.0 only
  • and 14 more

Published 2021-09-16. Last modified 2026-08-06.