Critical 1 exploited CVE DLA-2776-1 3 CVEs

apache2 - security update

Published Oct 2, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 9	apache2	2.4.25-3+deb9u11

Vulnerabilities 3

Critical 9.0

CVE-2021-40438 Exploited · Ransomware Public exploit Scanner template EPSS 100%

mod_proxy SSRF

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Sep 16, 2021
KEV Dec 1, 2021
Unscored —

CVE-2021-34798 EPSS 65%

NULL pointer dereference in httpd core

Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Sep 16, 2021
Unscored —

CVE-2021-39275 EPSS 39%

ap_escape_quotes buffer overflow

ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Sep 16, 2021