CVE-2021-40438 — mod_proxy SSRF

Description

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache HTTP Server	Apache HTTP Server 2.4 – ≤ 2.4.48	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	apache2	2.4.49-1	—
Debian 13	apache2	2.4.49-1	—
Debian 12	apache2	2.4.49-1	—
Debian 11	apache2	2.4.51-1~deb11u1	DSA-4982-1
Debian 10	apache2	2.4.38-3+deb10u6	DSA-4982-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Debian 9	apache2	2.4.25-3+deb9u11	DLA-2776-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 20.04 LTS	apache2	2.4.41-4ubuntu3.6	USN-5090-1
Ubuntu 18.04 LTS	apache2	2.4.29-1ubuntu4.18	USN-5090-1

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	apache2	2.4.18-2ubuntu3.17+esm3	USN-5090-2
Ubuntu Pro 14.04 LTS	apache2	2.4.7-1ubuntu4.22+esm2	USN-5090-2

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 8	httpd +6	2.4.37-39.module+el8.4.0+12865+a7065a39.1	RHSA-2021:3816
RHEL 8	mod_http2	1.15.7-3.module+el8.4.0+8625+d397f3da	RHSA-2021:3816
RHEL 8	mod_md	1:2.0.8-8.module+el8.3.0+6814+67d1e611	RHSA-2021:3816
RHEL 8	mod_ssl +1	1:2.4.37-39.module+el8.4.0+12865+a7065a39.1	RHSA-2021:3816
RHEL 7	httpd +5	2.4.6-97.el7_9.1	RHSA-2021:3856
RHEL 7	mod_ssl +1	1:2.4.6-97.el7_9.1	RHSA-2021:3856
RHEL 3	httpd24-httpd +5	2.4.34-22.el7.1	RHSA-2021:3754
RHEL 3	httpd24-mod_ssl +1	1:2.4.34-22.el7.1	RHSA-2021:3754

Show 12 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 8.2 EUS	httpd +6	2.4.37-21.module+el8.2.0+12904+53ee7aba.1	RHSA-2021:3836
RHEL 8.2 EUS	mod_http2	1.11.3-3.module+el8.2.0+7758+84b4ca3e.1	RHSA-2021:3836
RHEL 8.2 EUS	mod_md	1:2.0.8-7.module+el8.2.0+5531+7e4d69a2	RHSA-2021:3836
RHEL 8.2 EUS	mod_ssl +1	1:2.4.37-21.module+el8.2.0+12904+53ee7aba.1	RHSA-2021:3836
RHEL 8.1 EUS	httpd +7	2.4.37-16.module+el8.1.0+12900+7e6e5641.1	RHSA-2021:3837
RHEL 8.1 EUS	mod_http2	1.11.3-3.module+el8.1.0+7763+babdfe5b.1	RHSA-2021:3837
RHEL 8.1 EUS	mod_ssl +1	1:2.4.37-16.module+el8.1.0+12900+7e6e5641.1	RHSA-2021:3837
RHEL 7.7 TUS	httpd +5	2.4.6-90.el7_7.1	RHSA-2021:3856
RHEL 7.7 TUS	mod_ssl +1	1:2.4.6-90.el7_7.1	RHSA-2021:3856
RHEL 7.7 E4S	httpd +5	2.4.6-90.el7_7.1	RHSA-2021:3856
RHEL 7.7 E4S	mod_ssl +1	1:2.4.6-90.el7_7.1	RHSA-2021:3856
RHEL 7.7 AUS	httpd +5	2.4.6-90.el7_7.1	RHSA-2021:3856
RHEL 7.7 AUS	mod_ssl +1	1:2.4.6-90.el7_7.1	RHSA-2021:3856
RHEL 7.6 TUS	httpd +5	2.4.6-89.el7_6.2	RHSA-2021:3856
RHEL 7.6 TUS	mod_ssl +1	1:2.4.6-89.el7_6.2	RHSA-2021:3856
RHEL 7.6 E4S	httpd +5	2.4.6-89.el7_6.2	RHSA-2021:3856
RHEL 7.6 E4S	mod_ssl +1	1:2.4.6-89.el7_6.2	RHSA-2021:3856
RHEL 7.6 AUS	httpd +5	2.4.6-89.el7_6.2	RHSA-2021:3856
RHEL 7.6 AUS	mod_ssl +1	1:2.4.6-89.el7_6.2	RHSA-2021:3856
RHEL 7.4 AUS	httpd +5	2.4.6-67.el7_4.7	RHSA-2021:3856
RHEL 7.4 AUS	mod_ssl +1	1:2.4.6-67.el7_4.7	RHSA-2021:3856
RHEL 7.3 AUS	httpd +5	2.4.6-45.el7_3.6	RHSA-2021:3856
RHEL 7.3 AUS	mod_ssl +1	1:2.4.6-45.el7_3.6	RHSA-2021:3856
RHEL 7.2 AUS	httpd +5	2.4.6-40.el7_2.7	RHSA-2021:3856
RHEL 7.2 AUS	mod_ssl +1	1:2.4.6-40.el7_2.7	RHSA-2021:3856
Red Hat JBoss Core Services 1	jbcs-httpd24-httpd +6	2.4.37-76.el8jbcs	RHSA-2021:3746
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_cluster-native	1.3.16-7.Final_redhat_2.el8jbcs	RHSA-2021:3746
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_http2	1.15.7-19.el8jbcs	RHSA-2021:3746
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_jk +2	1.2.48-18.redhat_1.el8jbcs	RHSA-2021:3746
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_md	1:2.0.8-38.el8jbcs	RHSA-2021:3746
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_security	2.9.2-65.GA.el8jbcs	RHSA-2021:3746
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_ssl +1	1:2.4.37-76.el8jbcs	RHSA-2021:3746

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 8	httpd +6	2.4.37-43.module_el8.5.0+2597+c4b14997.alma	ALSA-2021:4537
AlmaLinux 8	mod_http2	1.15.7-3.module_el8.5.0+2609+b30d9eec	ALSA-2021:4537, ALSA-2021:3816, ALBA-2021:4604
AlmaLinux 8	mod_md	1:2.0.8-8.module_el8.5.0+2609+b30d9eec	ALSA-2021:4537, ALSA-2021:3816, ALBA-2021:4604
AlmaLinux 8	mod_ssl +1	1:2.4.37-43.module_el8.5.0+2597+c4b14997.alma	ALSA-2021:4537

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 8	httpd	2.4.37-39.module+el8.4.0+571+fd70afb1	RLSA-2021:3816
Rocky Linux 8	mod_http2	1.15.7-3.module+el8.4.0+553+7a69454b	RLSA-2021:3816
Rocky Linux 8	mod_md	1:2.0.8-8.module+el8.4.0+553+7a69454b	RLSA-2021:3816

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP3	apache2	2.4.43-3.32.1	SUSE-SU-2021:3522-1
SLES 15 SP2	apache2	2.4.43-3.32.1	SUSE-SU-2021:3522-1
SLES 15 SP1	apache2	2.4.33-3.55.1	SUSE-SU-2021:3335-1
SLES 15	apache2	2.4.33-3.55.1	SUSE-SU-2021:3335-1
SLES 12 SP5	apache2	2.4.23-29.80.1	SUSE-SU-2021:3299-1

Show 16 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 12 SP4	apache2	2.4.23-29.80.1	SUSE-SU-2021:3299-1
SLES 12 SP3	apache2	2.4.23-29.80.1	SUSE-SU-2021:3299-1
SLES 12 SP2	apache2	2.4.23-29.80.1	SUSE-SU-2021:3299-1
SLES for SAP 15 SP1	apache2	2.4.33-3.55.1	SUSE-SU-2021:3335-1
SLES for SAP 15	apache2	2.4.33-3.55.1	SUSE-SU-2021:3335-1
SLES for SAP 12 SP5	apache2	2.4.23-29.80.1	SUSE-SU-2021:3299-1
SLES for SAP 12 SP4	apache2	2.4.23-29.80.1	SUSE-SU-2021:3299-1
SLES for SAP 12 SP3	apache2	2.4.23-29.80.1	SUSE-SU-2021:3299-1
SLE HPC 15 SP1	apache2	2.4.33-3.55.1	SUSE-SU-2021:3335-1
SLE HPC 15	apache2	2.4.33-3.55.1	SUSE-SU-2021:3335-1
SUSE OpenStack Cloud Crowbar 9	apache2	2.4.23-29.80.1	SUSE-SU-2021:3299-1
SUSE OpenStack Cloud Crowbar 8	apache2	2.4.23-29.80.1	SUSE-SU-2021:3299-1
SUSE OpenStack Cloud 9	apache2	2.4.23-29.80.1	SUSE-SU-2021:3299-1
SUSE OpenStack Cloud 8	apache2	2.4.23-29.80.1	SUSE-SU-2021:3299-1
SUSE HPE Helion OpenStack 8	apache2	2.4.23-29.80.1	SUSE-SU-2021:3299-1
SUSE Enterprise Storage 6	apache2	2.4.33-3.55.1	SUSE-SU-2021:3335-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	owasp-modsecurity-crs	4.9.0-1.1	openSUSE-SU-2025:14708-1
openSUSE Leap 15.3	apache2	2.4.43-3.32.1	openSUSE-SU-2021:3522-1
openSUSE Leap 15.2	apache2	2.4.43-lp152.2.21.1	openSUSE-SU-2021:1438-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	apache2	2.4.49-r0	—
Alpine v3.23	apache2	2.4.49-r0	—
Alpine v3.22	apache2	2.4.49-r0	—
Alpine v3.21	apache2	2.4.49-r0	—
Alpine v3.20	apache2	2.4.49-r0	—

Show 9 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	apache2	2.4.49-r0	—
Alpine v3.18	apache2	2.4.49-r0	—
Alpine v3.17	apache2	2.4.49-r0	—
Alpine v3.16	apache2	2.4.49-r0	—
Alpine v3.15	apache2	2.4.49-r0	—
Alpine v3.14	apache2	2.4.49-r0	—
Alpine v3.13	apache2	2.4.49-r0	—
Alpine v3.12	apache2	2.4.49-r0	—
Alpine v3.11	apache2	2.4.49-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2	httpd +7	2.4.51-1.amzn2	ALAS2-2021-1716
Amazon Linux 2	mod_ssl +1	1:2.4.51-1.amzn2	ALAS2-2021-1716

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 2 (CBL-Mariner)	httpd	2.4.52-1	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 8	httpd +6	2.4.37-39.0.1.module+el8.4.0+20372+b87b2deb.1	ELSA-2021-3816
Oracle Linux 8	mod_http2	1.15.7-3.module+el8.4.0+20024+b87b2deb	ELSA-2021-3816
Oracle Linux 8	mod_md	1:2.0.8-8.module+el8.3.0+7816+49791cfd	ELSA-2021-3816
Oracle Linux 8	mod_ssl +1	1:2.4.37-39.0.1.module+el8.4.0+20372+b87b2deb.1	ELSA-2021-3816
Oracle Linux 7	httpd +5	2.4.6-97.0.1.el7_9.1	ELSA-2021-3856
Oracle Linux 7	mod_ssl +1	1:2.4.6-97.0.1.el7_9.1	ELSA-2021-3856

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 11 repositories · most starred shown

Kashkovsky/CVE-2021-40438 ★ 20 · Apr 3, 2022

Apache forward request CVE
sixpacksecurity/CVE-2021-40438 ★ 15 · Oct 24, 2021

CVE-2021-40438 exploit PoC with Docker setup.
sergiovks/CVE-2021-40438-Apache-2.4.48-SSRF-exploit ★ 11 · Dec 12, 2023

CVE-2021-40438 Apache <= 2.4.48 SSRF exploit
xiaojiangxl/CVE-2021-40438 ★ 7 · Oct 18, 2021
BabyTeam1024/CVE-2021-40438 ★ 2 · Oct 28, 2021
Cappricio-Securities/CVE-2021-40438 ★ 1 · May 19, 2024

Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery
gassara-kys/CVE-2021-40438 ★ 1 · Jun 10, 2022

check CVE-2021-40438
pisut4152/Sigma-Rule-for-CVE-2021-40438-exploitation-attempt ★ 1 · Nov 30, 2021

Sigma-Rule-for-CVE-2021-40438-Attack-Attemp
yakir2b/check-point-gateways-rce ★ 0 · Jan 22, 2025

Check Point Security Gateways RCE via CVE-2021-40438
ericmann/apache-cve-poc ★ 0 · Nov 11, 2021

Dockerized Proof-of-Concept of CVE-2021-40438 in Apache 2.4.48.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery http/cves/2021/CVE-2021-40438.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Advisories 28

ALBA-2021:4604 httpd:2.4 bug fix update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2021:4537 Important: httpd:2.4 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2021:3816 Important: httpd:2.4 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2021:3856 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2021:3836 Red Hat Security Advisory: httpd:2.4 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2021:3837 Red Hat Security Advisory: httpd:2.4 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2021:3816 Red Hat Security Advisory: httpd:2.4 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2021:3746 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP9 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2021:3754 Red Hat Security Advisory: httpd24-httpd security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
USN-5090-2 apache2 vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
USN-5090-1 apache2 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
DSA-4982-1 apache2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-2776-1 apache2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
RLSA-2021:3816 Important: httpd:2.4 security update Rocky Linux Security Advisories · Feb 4, 2026
SUSE-SU-2021:3335-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2021:3522-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2025:14708-1 owasp-modsecurity-crs-4.9.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:3522-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2021:1438-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:3299-1 Security update for apache2 SUSE / openSUSE Security Updates · May 2, 2025
WID-SEC-2022-0724 Apache HTTP Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 29, 2025
WID-SEC-2024-1591 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
WID-SEC-2024-0186 HPE OneView: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 23, 2024
ICSA-22-167-06 Siemens Apache HTTP Server CISA ICS & IT advisories · Oct 11, 2022
SSA-685781 SSA-685781: Multiple Vulnerabilities in Apache HTTP Server Affecting Siemens Products Siemens ProductCERT · Oct 11, 2022
ALAS2-2021-1716 Important: httpd security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 15, 2021
ELSA-2021-3856 Important: httpd security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 14, 2021
ELSA-2021-3816 Important: httpd:2.4 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 13, 2021

References

https://httpd.apache.org/security/vulnerabilities_24.html
FEDORA-2021-dce7e7738e vendor-advisory
[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info mailing-list
[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info mailing-list
[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info mailing-list
[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info mailing-list
FEDORA-2021-e3f6dd670d vendor-advisory
[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update mailing-list
[httpd-bugs] 20211008 [Bug 65616] CVE-2021-36160 regression mailing-list
DSA-4982 vendor-advisory
[httpd-users] 20211019 [users@httpd] Regarding CVE-2021-40438 mailing-list
[httpd-users] 20211019 Re: [users@httpd] Regarding CVE-2021-40438 mailing-list
20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021 vendor-advisory
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.tenable.com/security/tns-2021-17
https://security.netapp.com/advisory/ntap-20211008-0004/
https://www.oracle.com/security-alerts/cpuapr2022.html
https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf
GLSA-202208-20 vendor-advisory

EUVD	v3.1	9.0
CISA-ADP	v3.1	9.0