Critical 1 exploited CVE ALBA-2021:4604 1 CVE

httpd:2.4 bug fix update

Published Nov 10, 2021 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Bug Fix(es):

* proxy rewrite to unix socket fails with CVE-2021-40438 fix (BZ#2017854, BZ#2017855, BZ#2017856)

Fixed packages 3

Release	Package	Fixed in
AlmaLinux · 8	mod_http2	1.15.7-3.module_el8.5.0+2609+b30d9eec
AlmaLinux · 8	mod_md	1:2.0.8-8.module_el8.5.0+2609+b30d9eec
AlmaLinux · 8	mod_md	1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa

Vulnerabilities 1

Critical 9.0

CVE-2021-40438 Exploited · Ransomware Public exploit Scanner template EPSS 100%

mod_proxy SSRF

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Sep 16, 2021
KEV Dec 1, 2021