CVE-2021-40438
CriticalExploitedPublic exploitA crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.
Published Sep 8, 2022 · Updated Oct 16, 2026 · Also known as ALPINE-CVE-2021-40438, BIT-apache-2021-40438, DEBIAN-CVE-2021-40438, TR-21-0956, UBUNTU-CVE-2021-40438
Key Facts
Patch immediately- CVE-2021-40438 is a critical-severity vulnerability (CVSS 9.0 v3.1) affecting HTTP Server (Apache), Cloud Backup (Netapp), Clustered Data Ontap (Netapp) and 22 more products.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Dec 1, 2021 and is known to be used in ransomware campaigns. Public exploit code is available.
- EPSS estimates a 100% probability of exploitation in the next 30 days.
- Fixed versions are available, including apache 2.4.49, apache 2.4.49-1, HTTP Server <=2.4.48.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
9.0
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
100%
Higher than 99.9% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings, used by ransomware
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2021-40438 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Dec 1, 2021 | Dec 15, 2021 | Known |
| Industry KEV feed | Dec 1, 2021 | Dec 15, 2021 | Known |
| CIRCL KEV | Dec 1, 2021 | Dec 15, 2021 | Not reported |
| ENISA EUVD | Dec 1, 2021 | n/a | Not reported |
Required action: Apply updates per vendor instructions.
Affected Products
383 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| HTTP ServerApache | 12.2.1.3.0, 12.2.1.4.0, >= Apache HTTP Server 2.4 | 2.4.48 |
| Cloud BackupNetapp | See advisory | n/a |
| Clustered Data OntapNetapp | See advisory | n/a |
| StoragegridNetapp | See advisory | n/a |
| Enterprise Manager Ops CenterOracle | 12.4.0.0 | n/a |
Patched Releases
apache
2.4.49, 2.4.49-1
HTTP Server
<=2.4.48
apache2
2.4.18-2ubuntu3.17+esm2, 2.4.18-2ubuntu3.17+esm3, 2.4.23-29.80.1, 2.4.25-3+deb9u11, 2.4.29-1ubuntu4.17, 2.4.29-1ubuntu4.18, 2.4.33-3.55.1, 2.4.38-3+deb10u6, 2.4.41-4ubuntu3.5, 2.4.41-4ubuntu3.6, 2.4.43-3.32.1, 2.4.43-lp152.2.21.1, 2.4.49-1, 2.4.49-r0, 2.4.51-1~deb11u1, 2.4.7-1ubuntu4.22+esm2
apache2-devel
2.4.23-29.80.1, 2.4.33-3.55.1, 2.4.43-3.32.1, 2.4.43-lp152.2.21.1
apache2-doc
2.4.23-29.80.1, 2.4.33-3.55.1, 2.4.43-3.32.1, 2.4.43-lp152.2.21.1
apache2-event
2.4.43-3.32.1, 2.4.43-lp152.2.21.1
apache2-example-pages
2.4.23-29.80.1, 2.4.43-3.32.1, 2.4.43-lp152.2.21.1
apache2-prefork
2.4.23-29.80.1, 2.4.33-3.55.1, 2.4.43-3.32.1, 2.4.43-lp152.2.21.1
apache2-utils
2.4.23-29.80.1, 2.4.33-3.55.1, 2.4.43-3.32.1, 2.4.43-lp152.2.21.1
apache2-worker
2.4.23-29.80.1, 2.4.33-3.55.1, 2.4.43-3.32.1, 2.4.43-lp152.2.21.1
F5os
<=1.1.4
httpd
0:2.4.6-40.el7_2.7, 2.4.37-39.0.1.module+el8.4.0+20372+b87b2deb.1, 2.4.37-39.module+el8.4.0+571+fd70afb1, 2.4.48-3.ph1, 2.4.48-3.ph2, 2.4.48-3.ph3, 2.4.49-1, 2.4.51-1.amzn2, 2.4.52-1, 2.4.6-97.0.1.el7_9.1
httpd-devel
2.4.37-39.0.1.module+el8.4.0+20372+b87b2deb.1, 2.4.51-1.amzn2, 2.4.6-97.0.1.el7_9.1
httpd-filesystem
2.4.37-39.0.1.module+el8.4.0+20372+b87b2deb.1, 2.4.51-1.amzn2
httpd-manual
2.4.37-39.0.1.module+el8.4.0+20372+b87b2deb.1, 2.4.51-1.amzn2, 2.4.6-97.0.1.el7_9.1
httpd-tools
2.4.37-39.0.1.module+el8.4.0+20372+b87b2deb.1, 2.4.51-1.amzn2, 2.4.6-97.0.1.el7_9.1
httpd:2.4
8010020211008125020.c27ad7f8
httpd24
2.4.51-1.94.amzn1
httpd24-devel
2.4.51-1.94.amzn1
httpd24-httpd
0:2.4.34-22.el7.1
httpd24-manual
2.4.51-1.94.amzn1
httpd24-tools
2.4.51-1.94.amzn1
jbcs-httpd24-httpd
0:2.4.37-76.el8jbcs, 0:2.4.37-76.jbcs.el7
jbcs-httpd24-mod_cluster-native
0:1.3.16-7.Final_redhat_2.el8jbcs, 0:1.3.16-7.Final_redhat_2.jbcs.el7
jbcs-httpd24-mod_http2
0:1.15.7-19.el8jbcs, 0:1.15.7-19.jbcs.el7
Timeline
Added to CISA KEV
Dec 1, 2021
Added to Industry KEV feed
Dec 1, 2021
Added to CIRCL KEV
Dec 1, 2021
Added to ENISA EUVD
Dec 1, 2021
Publicly disclosed
Sep 8, 2022
Last updated
Oct 16, 2026
Weakness Type
- CWE-918 Server-Side Request Forgery (SSRF)
References
- advisoryhttp://access.redhat.com/errata/RHSA-2021:3841
- advisoryhttp://access.redhat.com/errata/RHSA-2021:3856
- advisoryRHSA-2021:3745
- advisoryRHSA-2021:3746
- advisoryRHSA-2021:3754
FAQ
Common Questions.
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.
Affected: HTTP Server (Apache) versions 12.2.1.3.0, 12.2.1.4.0, >= Apache HTTP Server 2.4; Cloud Backup (Netapp); Clustered Data Ontap (Netapp), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Dec 1, 2021 and is known to be used in ransomware campaigns.
Yes. It was added on Dec 1, 2021 with a federal remediation due date of Dec 15, 2021.
Public exploit code is available.
Fixed versions are available, including apache 2.4.49, apache 2.4.49-1, HTTP Server <=2.4.48.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2021-40438 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo