Dashboard / CVE-2021-40438

CVE-2021-40438

CISA KEV RANSOMWARE
ACT NOW Priority: 0.00 BB Relevance: 0/100
Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

CISA Known Exploited Vulnerability

Vendor / Product Apache — Apache
Date Added 2021-12-01
Remediation Due 2021-12-15
Ransomware Use CONFIRMED
https://nvd.nist.gov/vuln/detail/CVE-2021-40438

Weakness Classification (1)

Affected Software (83)

VendorProductVersion
apache http_server < 2.4.48
broadcom brocade_fabric_operating_system_firmware -
debian debian_linux 9.0
debian debian_linux 10.0
debian debian_linux 11.0
f5 f5os 1.1.0 – 1.1.4
f5 f5os 1.2.0 – 1.2.1
fedoraproject fedora 34
fedoraproject fedora 35
netapp cloud_backup -
netapp clustered_data_ontap -
netapp storagegrid -
oracle enterprise_manager_ops_center 12.4.0.0
oracle http_server 12.2.1.3.0
oracle http_server 12.2.1.4.0
oracle instantis_enterprisetrack 17.1
oracle instantis_enterprisetrack 17.2
oracle instantis_enterprisetrack 17.3
oracle secure_global_desktop 5.6
oracle zfs_storage_appliance_kit 8.8
redhat enterprise_linux 8.0
redhat enterprise_linux_eus 8.1
redhat enterprise_linux_eus 8.2
redhat enterprise_linux_eus 8.4
redhat enterprise_linux_eus 8.6
redhat enterprise_linux_eus 8.8
redhat enterprise_linux_for_arm_64 8.0
redhat enterprise_linux_for_arm_64_eus 8.6
redhat enterprise_linux_for_arm_64_eus 8.8
redhat enterprise_linux_for_ibm_z_systems 7.0_s390x
Showing 30 of 83 entries

References & Advisories (20)

https://www.debian.org/security/2021/dsa-4982
Mailing List Third Party Advisory

Bug Bounty Relevance

0 / 100
✓ Known exploited (KEV)

CVSS Score

Unscored

EPSS — Exploitation Probability

No EPSS data available

Intelligence Sources

kev ref →

External Links