CVE-2024-38475 — Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

Description

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.

Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache HTTP Server	2.4.0 – ≤ 2.4.59	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	apache2	2.4.60-1	—
Debian 13	apache2	2.4.60-1	—
Debian 12	apache2	2.4.61-1~deb12u1	DSA-5729-1
Debian 11	apache2	2.4.61-1~deb11u1	DSA-5729-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 24.04 LTS	apache2	2.4.58-1ubuntu8.2	USN-6885-1
Ubuntu 22.04 LTS	apache2	2.4.52-1ubuntu4.10	USN-6885-1
Ubuntu 20.04 LTS	apache2	2.4.41-4ubuntu3.19	USN-6885-1

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 18.04 LTS	apache2	2.4.29-1ubuntu4.27+esm3	USN-6885-3
Ubuntu Pro 16.04 LTS	apache2	2.4.18-2ubuntu3.17+esm13	USN-6885-3
Ubuntu Pro 14.04 LTS	apache2	2.4.7-1ubuntu4.22+esm10	USN-6885-5

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	httpd +8	2.4.57-11.el9_4	RHSA-2024:4726
RHEL 9	mod_ssl +1	1:2.4.57-11.el9_4	RHSA-2024:4726
RHEL 8	httpd +6	2.4.37-65.module+el8.10.0+22069+b47f5c72.1	RHSA-2024:4720
RHEL 8	mod_http2	1.15.7-10.module+el8.10.0+21653+eaff63f0	RHSA-2024:4720
RHEL 8	mod_md	1:2.0.8-8.module+el8.9.0+19080+567b90f8	RHSA-2024:4720
RHEL 8	mod_ssl +1	1:2.4.37-65.module+el8.10.0+22069+b47f5c72.1	RHSA-2024:4720

Show 13 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 9.2 EUS	httpd +8	2.4.53-11.el9_2.8	RHSA-2024:4862
RHEL 9.2 EUS	mod_ssl +1	1:2.4.53-11.el9_2.8	RHSA-2024:4862
RHEL 9.0 E4S	httpd +7	2.4.51-7.el9_0.7	RHSA-2024:4863
RHEL 9.0 E4S	mod_ssl +1	1:2.4.51-7.el9_0.7	RHSA-2024:4863
RHEL 8.8 EUS	httpd +6	2.4.37-56.module+el8.8.0+22079+e03f6970.8	RHSA-2024:4719
RHEL 8.8 EUS	mod_http2	1.15.7-8.module+el8.8.0+21773+20528f83.5	RHSA-2024:4719
RHEL 8.8 EUS	mod_md	1:2.0.8-8.module+el8.3.0+6814+67d1e611	RHSA-2024:4719
RHEL 8.8 EUS	mod_ssl +1	1:2.4.37-56.module+el8.8.0+22079+e03f6970.8	RHSA-2024:4719
RHEL 8.6 TUS	httpd +6	2.4.37-47.module+el8.6.0+22124+21ed7001.9	RHSA-2024:4827
RHEL 8.6 TUS	mod_http2	1.15.7-5.module+el8.6.0+21746+f601aac0.3	RHSA-2024:4827
RHEL 8.6 TUS	mod_md	1:2.0.8-8.module+el8.3.0+6814+67d1e611	RHSA-2024:4827
RHEL 8.6 TUS	mod_ssl +1	1:2.4.37-47.module+el8.6.0+22124+21ed7001.9	RHSA-2024:4827
RHEL 8.6 E4S	httpd +6	2.4.37-47.module+el8.6.0+22124+21ed7001.9	RHSA-2024:4827
RHEL 8.6 E4S	mod_http2	1.15.7-5.module+el8.6.0+21746+f601aac0.3	RHSA-2024:4827
RHEL 8.6 E4S	mod_md	1:2.0.8-8.module+el8.3.0+6814+67d1e611	RHSA-2024:4827
RHEL 8.6 E4S	mod_ssl +1	1:2.4.37-47.module+el8.6.0+22124+21ed7001.9	RHSA-2024:4827
RHEL 8.6 AUS	httpd +6	2.4.37-47.module+el8.6.0+22124+21ed7001.9	RHSA-2024:4827
RHEL 8.6 AUS	mod_http2	1.15.7-5.module+el8.6.0+21746+f601aac0.3	RHSA-2024:4827
RHEL 8.6 AUS	mod_md	1:2.0.8-8.module+el8.3.0+6814+67d1e611	RHSA-2024:4827
RHEL 8.6 AUS	mod_ssl +1	1:2.4.37-47.module+el8.6.0+22124+21ed7001.9	RHSA-2024:4827
RHEL 8.4 TUS	httpd +6	2.4.37-39.module+el8.4.0+22127+467cc488.8	RHSA-2024:4830
RHEL 8.4 TUS	mod_http2	1.15.7-3.module+el8.4.0+21747+916a74df.3	RHSA-2024:4830
RHEL 8.4 TUS	mod_md	1:2.0.8-8.module+el8.3.0+6814+67d1e611	RHSA-2024:4830
RHEL 8.4 TUS	mod_ssl +1	1:2.4.37-39.module+el8.4.0+22127+467cc488.8	RHSA-2024:4830
RHEL 8.4 E4S	httpd +6	2.4.37-39.module+el8.4.0+22127+467cc488.8	RHSA-2024:4830
RHEL 8.4 E4S	mod_http2	1.15.7-3.module+el8.4.0+21747+916a74df.3	RHSA-2024:4830
RHEL 8.4 E4S	mod_md	1:2.0.8-8.module+el8.3.0+6814+67d1e611	RHSA-2024:4830
RHEL 8.4 E4S	mod_ssl +1	1:2.4.37-39.module+el8.4.0+22127+467cc488.8	RHSA-2024:4830
RHEL 8.4 AUS	httpd +6	2.4.37-39.module+el8.4.0+22127+467cc488.8	RHSA-2024:4830
RHEL 8.4 AUS	mod_http2	1.15.7-3.module+el8.4.0+21747+916a74df.3	RHSA-2024:4830
RHEL 8.4 AUS	mod_md	1:2.0.8-8.module+el8.3.0+6814+67d1e611	RHSA-2024:4830
RHEL 8.4 AUS	mod_ssl +1	1:2.4.37-39.module+el8.4.0+22127+467cc488.8	RHSA-2024:4830
RHEL 8.2 AUS	httpd +6	2.4.37-21.module+el8.2.0+22128+68c62a5c.8	RHSA-2024:4820
RHEL 8.2 AUS	mod_http2	1.11.3-3.module+el8.2.0+22123+cf5a147c.4	RHSA-2024:4820
RHEL 8.2 AUS	mod_md	1:2.0.8-7.module+el8.2.0+5531+7e4d69a2	RHSA-2024:4820
RHEL 8.2 AUS	mod_ssl +1	1:2.4.37-21.module+el8.2.0+22128+68c62a5c.8	RHSA-2024:4820
RHEL 7.7 AUS	httpd +5	2.4.6-90.el7_7.4	RHSA-2024:4938
RHEL 7.7 AUS	mod_ssl +1	1:2.4.6-90.el7_7.4	RHSA-2024:4938
RHEL 7 ELS	httpd +5	2.4.6-99.el7_9.2	RHSA-2024:4943
RHEL 7 ELS	mod_ssl +1	1:2.4.6-99.el7_9.2	RHSA-2024:4943
Red Hat JBoss Core Services 1	jbcs-httpd24-httpd +6	2.4.57-13.el7jbcs	RHSA-2024:5239
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_http2	1.15.19-41.el7jbcs	RHSA-2024:5239
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_jk +1	1.2.49-11.redhat_1.el7jbcs	RHSA-2024:5239
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_md	1:2.4.24-11.el7jbcs	RHSA-2024:5239
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_proxy_cluster	1.3.20-8.el7jbcs	RHSA-2024:5239
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_security	2.9.3-40.el7jbcs	RHSA-2024:5239
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_ssl +1	1:2.4.57-13.el7jbcs	RHSA-2024:5239

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	httpd +8	2.4.57-11.el9_4	ALSA-2024:4726
AlmaLinux 9	mod_ssl +1	1:2.4.57-11.el9_4	ALSA-2024:4726
AlmaLinux 8	httpd +6	2.4.37-65.module_el8.10.0+3872+9b8ab21e.1	ALSA-2024:4720
AlmaLinux 8	mod_http2	1.15.7-10.module_el8.10.0+3832+564e7653	ALSA-2024:4720
AlmaLinux 8	mod_md	1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa	ALSA-2024:4720
AlmaLinux 8	mod_ssl +1	1:2.4.37-65.module_el8.10.0+3872+9b8ab21e.1	ALSA-2024:4720

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 9	httpd	2.4.57-11.el9_4	RLSA-2024:4726
Rocky Linux 8	httpd	2.4.37-65.module+el8.10.0+1830+22f0c9e0	RLSA-2024:4720
Rocky Linux 8	mod_http2	1.15.7-10.module+el8.10.0+1775+6b057638	RLSA-2024:4720
Rocky Linux 8	mod_md	1:2.0.8-8.module+el8.9.0+1370+89cc8ad5	RLSA-2024:4720

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP6	apache2	2.4.51-150400.6.29.1	SUSE-SU-2024:2624-1, SUSE-SU-2024:2597-1
SLES 15 SP6	apache2-devel +4	2.4.58-150600.5.18.1	SUSE-SU-2024:2597-1
SLES 15 SP5	apache2	2.4.51-150400.6.29.1	SUSE-SU-2026:2686-1, SUSE-SU-2024:2624-1
SLES 15 SP4	apache2	2.4.51-150400.6.29.1	SUSE-SU-2026:2686-1, SUSE-SU-2024:2624-1
SLES 15 SP3	apache2	2.4.51-150200.3.70.1	SUSE-SU-2024:2591-1
SLES 15 SP2	apache2	2.4.51-150200.3.70.1	SUSE-SU-2024:2591-1

Show 13 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 12 SP5	apache2 +1	2.4.51-35.51.1	SUSE-SU-2024:2436-1
SLES for SAP 15 SP5	apache2	2.4.66-150400.6.57.1	SUSE-SU-2026:2686-1
SLES for SAP 15 SP4	apache2	2.4.51-150400.6.29.1	SUSE-SU-2026:2686-1, SUSE-SU-2024:2624-1
SLES for SAP 15 SP3	apache2	2.4.51-150200.3.70.1	SUSE-SU-2024:2591-1
SLES for SAP 15 SP2	apache2	2.4.51-150200.3.70.1	SUSE-SU-2024:2591-1
SLES for SAP 12 SP5	apache2 +1	2.4.51-35.51.1	SUSE-SU-2024:2436-1
SLE HPC 15 SP5	apache2	2.4.66-150400.6.57.1	SUSE-SU-2026:2686-1
SLE HPC 15 SP4	apache2	2.4.51-150400.6.29.1	SUSE-SU-2026:2686-1, SUSE-SU-2024:2624-1
SLE HPC 15 SP3	apache2	2.4.51-150200.3.70.1	SUSE-SU-2024:2591-1
SLE HPC 15 SP2	apache2	2.4.51-150200.3.70.1	SUSE-SU-2024:2591-1
SUSE Manager Server 4.3	apache2	2.4.51-150400.6.29.1	SUSE-SU-2024:2624-1
SUSE Manager Proxy 4.3	apache2	2.4.51-150400.6.29.1	SUSE-SU-2024:2624-1
SUSE Enterprise Storage 7.1	apache2	2.4.51-150200.3.70.1	SUSE-SU-2024:2591-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	apache2	2.4.61-1.1	openSUSE-SU-2024:14116-1
openSUSE Leap 15.6	apache2 +6	2.4.58-150600.5.18.1	SUSE-SU-2024:2597-1
openSUSE Leap 15.5	apache2	2.4.51-150400.6.29.1	SUSE-SU-2024:2624-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	apache2	2.4.60-r0	—
Alpine v3.23	apache2	2.4.60-r0	—
Alpine v3.22	apache2	2.4.60-r0	—
Alpine v3.21	apache2	2.4.60-r0	—
Alpine v3.20	apache2	2.4.60-r0	—

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	apache2	2.4.60-r0	—
Alpine v3.18	apache2	2.4.60-r0	—
Alpine v3.17	apache2	2.4.60-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	httpd +8	2.4.61-1.amzn2023	ALAS2023-2024-656
Amazon Linux 2023	mod_ssl +1	1:2.4.61-1.amzn2023	ALAS2023-2024-656
Amazon Linux 2	httpd +7	2.4.61-1.amzn2.0.1	ALAS2-2024-2594
Amazon Linux 2	mod_ssl +1	1:2.4.61-1.amzn2.0.1	ALAS2-2024-2594

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	httpd +8	2.4.57-11.0.1.el9_4	ELSA-2024-4726
Oracle Linux 9	mod_ssl +1	1:2.4.57-11.0.1.el9_4	ELSA-2024-4726
Oracle Linux 8	httpd +6	2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1	ELSA-2024-4720
Oracle Linux 8	mod_http2	1.15.7-10.module+el8.10.0+90327+96b8ea28	ELSA-2024-4720
Oracle Linux 8	mod_md	1:2.0.8-8.module+el8.9.0+90011+2f9c6a23	ELSA-2024-4720
Oracle Linux 8	mod_ssl +1	1:2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1	ELSA-2024-4720
Oracle Linux 7	httpd +5	2.4.6-99.0.3.el7_9.1	ELSA-2024-4943
Oracle Linux 7	mod_ssl +1	1:2.4.6-99.0.3.el7_9.1	ELSA-2024-4943

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 6 repositories

p0in7s/CVE-2024-38475 ★ 17 · Aug 18, 2024
soltanali0/CVE-2024-38475 ★ 5 · Dec 12, 2024

exploit CVE-2024-38475(mod_rewrite weakness with filesystem path matching)
akabul0us/apache_poc ★ 0 · Oct 17, 2026

CVE-2024-38475
Nyakki-Labs-0x420/Myesve ★ 0 · May 31, 2026

CVE-2024-38475 exploitation & scanning tool with Mullvad VPN rotation
syaifulandy/CVE-2024-38475 ★ 0 · May 9, 2025

CVE-2024-38475 Scanner using FFUF + Seclists
abrewer251/CVE-2024-38475_SonicBoom_Apache_URL_Traversal_PoC ★ 0 · May 7, 2025

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Sonicwall - Pre-Authentication Arbitrary File Read http/cves/2024/CVE-2024-38475.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Advisories 38

WID-SEC-2024-1504 Apache HTTP Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
ALSA-2024:4726 Important: httpd security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2024:4720 Important: httpd:2.4 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2024:5239 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP5 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2024:4943 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2024:4863 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2024:4938 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2024:4862 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2024:4830 Red Hat Security Advisory: httpd:2.4 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2024:4827 Red Hat Security Advisory: httpd:2.4 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2024:4726 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2024:4820 Red Hat Security Advisory: httpd:2.4 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2024:4720 Red Hat Security Advisory: httpd:2.4 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2024:4719 Red Hat Security Advisory: httpd:2.4 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
WID-SEC-2025-0148 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
SUSE-SU-2026:2686-1 Security update for apache2 SUSE / openSUSE Security Updates · Jul 1, 2026
USN-6885-3 apache2 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
USN-6885-1 apache2 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
USN-6885-5 apache2 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
DSA-5729-1 apache2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
RLSA-2024:4726 Important: httpd security update Rocky Linux Security Advisories · Feb 5, 2026
SUSE-SU-2024:2436-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:14116-1 apache2-2.4.61-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:2597-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:2624-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:2591-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2025-0143 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 17, 2025
RLSA-2024:4720 Important: httpd:2.4 security update Rocky Linux Security Advisories · May 7, 2025
NCSC-2025-0027 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jan 22, 2025
NCSC-2025-0021 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jan 22, 2025
NCSC-2024-0464 Kwetsbaarheden verholpen in SonicWall SMA100 SSLVPN NCSC-NL (Netherlands) · Dec 6, 2024
NCSC-2024-0411 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Oct 17, 2024
ELSA-2024-4943 Important: httpd security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 13, 2024
ELSA-2024-4726 Important: httpd security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 23, 2024
ELSA-2024-4720 Important: httpd:2.4 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 23, 2024
ALAS2023-2024-656 Important: httpd security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 22, 2024
ALAS2-2024-2594 Important: httpd security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 22, 2024
NCSC-2024-0275 Kwetsbaarheden verholpen in Apache HHTP-server NCSC-NL (Netherlands) · Jul 2, 2024

EUVD	v3.1	9.1
CISA-ADP	v3.1	9.1

Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Alpine

Amazon Linux

Oracle Linux

Public exploits

GitHub 6 repositories

Automated scanner template

Advisories 38

References