{"id":"CVE-2021-40438","published":"2021-09-16T15:15:07Z","modified":"2026-08-06T05:16:35Z","title":"Apache HTTP Server-Side Request Forgery (SSRF)","vendor":"Apache","product":"Apache","tier":"core","eol":null,"description":{"text":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in Apache HTTP Server's mod_proxy component allows a crafted request URI path to cause the server to forward requests to an origin server chosen by the remote user, affecting Apache HTTP Server 2.4.48 and earlier. An unauthenticated remote attacker can exploit this over the network by sending a specially crafted request, with no user interaction required, though exploitation is noted as having high complexity.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:51Z"},"cvss":{"score":9.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":0.99997,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2021-12-01","dueDate":"2021-12-15","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-40438","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-12-01","exploitedFirstSeen":"2021-12-01","ransomware":true,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-12-01"},{"url":"https://unit42.paloaltonetworks.com/network-attacks-trends-august-october-2021/","date":"2021-12-21"},{"url":"https://www.trendmicro.com/en_us/research/22/b/recent-cyberattacks-open-source-web-servers.html","date":"2022-02-22"},{"url":"https://info.securin.io/hubfs/Securin%20Ransomware%20Report%202023.pdf","date":"2023-02-14"},{"url":"https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/unit42-cloud-threat-report-volume7.pdf","date":"2023-04-18"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa23-215a","date":"2023-08-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-06&host_type=src&vulnerability=cve-2021-40438","date":"2023-12-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-24&host_type=src&vulnerability=cve-2021-40438","date":"2023-12-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-14&host_type=src&vulnerability=cve-2021-40438","date":"2024-01-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2021-40438","date":"2024-01-22"}],"evidenceTotal":591,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf","tags":["Third Party Advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["Release Notes","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/","tags":["Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/","tags":["Release Notes"]},{"url":"https://security.gentoo.org/glsa/202208-20","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20211008-0004/","tags":["Third Party Advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ","tags":["Broken Link","Third Party Advisory"]},{"url":"https://www.debian.org/security/2021/dsa-4982","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.tenable.com/security/tns-2021-17","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf","tags":["Third Party Advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["Release Notes","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/","tags":["Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/","tags":["Release Notes"]},{"url":"https://security.gentoo.org/glsa/202208-20","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20211008-0004/","tags":["Third Party Advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ","tags":["Broken Link","Third Party Advisory"]},{"url":"https://www.debian.org/security/2021/dsa-4982","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.tenable.com/security/tns-2021-17","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40438","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Crafted HTTP request exploits public-facing Apache server","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"A crafted request uri-path can cause mod_proxy to forward the request","start":0,"end":69}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1090","name":"Proxy","tactics":["command-and-control"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Proxy redirection to attacker-chosen origin server","mappingType":"primary_impact","evidence":[{"from":"description","quote":"forward the request to an origin server choosen by the remote user","start":50,"end":116}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-27615","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-27615","exploited":true,"exploitedSince":"2021-12-01","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":10,"skipped":1,"earliest":"2021-10-18","earliestUrl":"https://github.com/xiaojiangxl/CVE-2021-40438","repos":[{"name":"Kashkovsky/CVE-2021-40438","url":"https://github.com/Kashkovsky/CVE-2021-40438","stars":18,"created":"2022-04-03"},{"name":"sixpacksecurity/CVE-2021-40438","url":"https://github.com/sixpacksecurity/CVE-2021-40438","stars":13,"created":"2021-10-24"},{"name":"sergiovks/CVE-2021-40438-Apache-2.4.48-SSRF-exploit","url":"https://github.com/sergiovks/CVE-2021-40438-Apache-2.4.48-SSRF-exploit","stars":11,"created":"2023-12-12"},{"name":"xiaojiangxl/CVE-2021-40438","url":"https://github.com/xiaojiangxl/CVE-2021-40438","stars":5,"created":"2021-10-18"},{"name":"BabyTeam1024/CVE-2021-40438","url":"https://github.com/BabyTeam1024/CVE-2021-40438","stars":2,"created":"2021-10-28"}]},"nuclei":[{"id":"CVE-2021-40438","name":"Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery","severity":"critical","path":"http/cves/2021/CVE-2021-40438.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40438.yaml"}],"first":{"date":"2021-10-18","source":"PoC-in-GitHub","url":"https://github.com/xiaojiangxl/CVE-2021-40438"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1090"],"provenance":"ai"}],"timeline":[{"date":"2021-09-16","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40438","provenance":"source"},{"date":"2021-10-18","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/xiaojiangxl/CVE-2021-40438","provenance":"source"},{"date":"2021-12-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2021-12-01","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-12-01","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-27615","provenance":"source"}],"speed":{"daysToPublicExploit":32,"firstExploitFrom":"PoC-in-GitHub","daysToKev":76},"priority":{"score":79.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1795 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 1.0000"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"10 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.3,"detail":"base score 9.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}