Description
SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.
Users are recommended to upgrade to version 2.4.62 which fixes this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server | 2.4.0 – ≤ 2.4.61 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2 | 2.4.62-1.1 | openSUSE-SU-2024:14245-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | apache2 | 2.4.62-r0 | — |
| Alpine v3.23 | apache2 | 2.4.62-r0 | — |
| Alpine v3.22 | apache2 | 2.4.62-r0 | — |
| Alpine v3.21 | apache2 | 2.4.62-r0 | — |
| Alpine v3.20 | apache2 | 2.4.62-r0 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | apache2 | 2.4.62-r0 | — |
| Alpine v3.18 | apache2 | 2.4.62-r0 | — |
| Alpine v3.17 | apache2 | 2.4.62-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
ForceEA001/CVE-2024-40898-SSL-Bypass-Detection ★ 2 · Jun 30, 2025
This Python script is a Proof-of-Concept (PoC) scanner for detecting the vulnerability CVE-2024-40898, which affects Apache HTTP Server’s SSL certificate validation.
-
anilpatel199n/CVE-2024-40898 ★ 1 · Jun 14, 2025
This Python script checks for the presence of CVE-2024-40898, a critical vulnerability in Apache HTTP Server that may allow SSL/TLS certificate verification bypass under certain misconfigurations. It…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 9
- WID-SEC-2024-3195 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2024-1663 Apache HTTP Server: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen BSI CERT-Bund (WID) · Jun 30, 2026
- openSUSE-SU-2024:14245-1 apache2-2.4.62-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- NCSC-2025-0027 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jan 22, 2025
- NCSC-2024-0414 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Oct 17, 2024
- NCSC-2024-0411 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-3196 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
- NCSC-2024-0339 Kwetsbaarheden verholpen in Microsoft Mariner NCSC-NL (Netherlands) · Aug 13, 2024
- NCSC-2024-0314 Kwetsbaarheden verholpen in Apache HTTP Server NCSC-NL (Netherlands) · Jul 19, 2024
References
- https://httpd.apache.org/security/vulnerabilities_24.html vendor-advisory