Skip to content
OpenAdvisories
Medium · 5.3 Public exploit CVE-2024-40725 EUVD-2024-38590GHSA-x749-289q-pg9q

Apache HTTP Server: source code disclosure with handlers configured via AddType

Published Jul 18, 2024 · Updated Mar 14, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache HTTP Server Package: apache2 Package: apache2 Package: apache2 Package: httpd Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

A partial fix for  CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.

Users are recommended to upgrade to version 2.4.62, which fixes this issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache HTTP Server 2.4.60 – ≤ 2.4.61 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 apache2 2.4.62-1 —
Debian 13 apache2 2.4.62-1 —
Debian 12 apache2 2.4.62-1~deb12u1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS apache2 2.4.58-1ubuntu8.4 USN-6902-1
Ubuntu 22.04 LTS apache2 2.4.52-1ubuntu4.12 USN-6902-1
Ubuntu 20.04 LTS apache2 2.4.41-4ubuntu3.21 USN-6902-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 14.04 LTS apache2 No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 apache2 2.4.51-150400.6.37.1 SUSE-SU-2024:3864-1, SUSE-SU-2024:3742-1
SLES 15 SP6 apache2-devel +4 2.4.58-150600.5.26.1 SUSE-SU-2024:3742-1
SLES 15 SP5 apache2 2.4.51-150400.6.37.1 SUSE-SU-2026:2686-1, SUSE-SU-2024:3864-1
SLES 15 SP4 apache2 2.4.51-150400.6.37.1 SUSE-SU-2026:2686-1, SUSE-SU-2024:3864-1
SLES 15 SP3 apache2 2.4.51-150200.3.79.1 SUSE-SU-2025:02241-1
SLES 12 SP5 apache2 +1 2.4.51-35.63.1 SUSE-SU-2024:3750-1
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP5 apache2 2.4.66-150400.6.57.1 SUSE-SU-2026:2686-1
SLES for SAP 15 SP4 apache2 2.4.51-150400.6.37.1 SUSE-SU-2026:2686-1, SUSE-SU-2024:3864-1
SLES for SAP 15 SP3 apache2 2.4.51-150200.3.79.1 SUSE-SU-2025:02241-1
SLES for SAP 12 SP5 apache2 +1 2.4.51-35.63.1 SUSE-SU-2024:3750-1
SLE HPC 15 SP5 apache2 2.4.66-150400.6.57.1 SUSE-SU-2026:2686-1
SLE HPC 15 SP4 apache2 2.4.51-150400.6.37.1 SUSE-SU-2026:2686-1, SUSE-SU-2024:3864-1
SLE HPC 15 SP3 apache2 2.4.51-150200.3.79.1 SUSE-SU-2025:02241-1
SUSE Manager Server 4.3 apache2 2.4.51-150400.6.37.1 SUSE-SU-2024:3864-1
SUSE Manager Proxy 4.3 apache2 2.4.51-150400.6.37.1 SUSE-SU-2024:3864-1
SUSE Enterprise Storage 7.1 apache2 2.4.51-150200.3.79.1 SUSE-SU-2025:02241-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed apache2 2.4.62-1.1 openSUSE-SU-2024:14245-1
openSUSE Leap 15.6 apache2 +6 2.4.58-150600.5.26.1 SUSE-SU-2024:3742-1
openSUSE Leap 15.5 apache2 2.4.51-150400.6.37.1 SUSE-SU-2024:3864-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 apache2 2.4.62-r0 —
Alpine v3.23 apache2 2.4.62-r0 —
Alpine v3.22 apache2 2.4.62-r0 —
Alpine v3.21 apache2 2.4.62-r0 —
Alpine v3.20 apache2 2.4.62-r0 —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 apache2 2.4.62-r0 —
Alpine v3.18 apache2 2.4.62-r0 —
Alpine v3.17 apache2 2.4.62-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 httpd +8 2.4.62-1.amzn2023 ALAS2023-2024-681
Amazon Linux 2023 mod_ssl +1 1:2.4.62-1.amzn2023 ALAS2023-2024-681
Amazon Linux 2 httpd +7 2.4.62-1.amzn2.0.1 ALAS2-2024-2606
Amazon Linux 2 mod_ssl +1 1:2.4.62-1.amzn2.0.1 ALAS2-2024-2606

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 httpd 2.4.62-1 —
Azure Linux 2 (CBL-Mariner) httpd 2.4.62-1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

  • TAM-K592/CVE-2024-40725-CVE-2024-40898 ★ 87 · Jul 19, 2024

    CVE-2024-40725 and CVE-2024-40898, affecting Apache HTTP Server versions 2.4.0 through 2.4.61. These flaws pose significant risks to web servers worldwide, potentially leading to source code disclosu…

  • soltanali0/CVE-2024-40725 ★ 12 · Dec 18, 2024

    exploit CVE-2024-40725 (Apache httpd) with

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 12

References