{"history":[{"alert":0,"cve":"CVE-2021-40438","id":22310,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.99999, \"percentile\": 0.99997}"},{"alert":0,"cve":"CVE-2021-40438","id":19929,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.99999, \"percentile\": 0.99997}"},{"alert":0,"cve":"CVE-2021-40438","id":17895,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.99999, \"percentile\": 0.99997}"},{"alert":0,"cve":"CVE-2021-40438","id":15959,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.99999, \"percentile\": 0.99997}"},{"alert":0,"cve":"CVE-2021-40438","id":13937,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.99999, \"percentile\": 0.99997}"},{"alert":0,"cve":"CVE-2021-40438","id":11719,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.99999, \"percentile\": 0.99997}"},{"alert":0,"cve":"CVE-2021-40438","id":9705,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.99999, \"percentile\": 0.99997}"},{"alert":1,"cve":"CVE-2021-40438","id":8389,"kind":"cna","observed_at":1793852400,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2024-08-04T02:44:10.131Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://httpd.apache.org/security/vulnerabilities_24.html\"}, {\"name\": \"FEDORA-2021-dce7e7738e\", \"tags\": [\"vendor-advisory\", \"x_refsource_FEDORA\", \"x_transferred\"], \"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/\"}, {\"name\": \"[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info\", \"tags\": [\"mailing-list\", \"x_refsource_MLIST\", \"x_transferred\"], \"url\": \"https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E\"}, {\"name\": \"[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info\", \"tags\": [\"mailing-list\", \"x_refsource_MLIST\", \"x_transferred\"], \"url\": \"https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E\"}, {\"name\": \"[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info\", \"tags\": [\"mailing-list\", \"x_refsource_MLIST\", \"x_transferred\"], \"url\": \"https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E\"}, {\"name\": \"[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info\", \"tags\": [\"mailing-list\", \"x_refsource_MLIST\", \"x_transferred\"], \"url\": \"https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E\"}, {\"name\": \"FEDORA-2021-e3f6dd670d\", \"tags\": [\"vendor-advisory\", \"x_refsource_FEDORA\", \"x_transferred\"], \"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/\"}, {\"name\": \"[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update\", \"tags\": [\"mailing-list\", \"x_refsource_MLIST\", \"x_transferred\"], \"url\": \"https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html\"}, {\"name\": \"[httpd-bugs] 20211008 [Bug 65616] CVE-2021-36160 regression\", \"tags\": [\"mailing-list\", \"x_refsource_MLIST\", \"x_transferred\"], \"url\": \"https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E\"}, {\"name\": \"DSA-4982\", \"tags\": [\"vendor-advisory\", \"x_refsource_DEBIAN\", \"x_transferred\"], \"url\": \"https://www.debian.org/security/2021/dsa-4982\"}, {\"name\": \"[httpd-users] 20211019 [users@httpd] Regarding CVE-2021-40438\", \"tags\": [\"mailing-list\", \"x_refsource_MLIST\", \"x_transferred\"], \"url\": \"https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E\"}, {\"name\": \"[httpd-users] 20211019 Re: [users@httpd] Regarding CVE-2021-40438\", \"tags\": [\"mailing-list\", \"x_refsource_MLIST\", \"x_transferred\"], \"url\": \"https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E\"}, {\"name\": \"20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021\", \"tags\": [\"vendor-advisory\", \"x_refsource_CISCO\", \"x_transferred\"], \"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://www.oracle.com/security-alerts/cpujan2022.html\"}, {\"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"https://www.tenable.com/security/tns-2021-17\"}, {\"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"https://security.netapp.com/advisory/ntap-20211008-0004/\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://www.oracle.com/security-alerts/cpuapr2022.html\"}, {\"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf\"}, {\"name\": \"GLSA-202208-20\", \"tags\": [\"vendor-advisory\", \"x_refsource_GENTOO\", \"x_transferred\"], \"url\": \"https://security.gentoo.org/glsa/202208-20\"}], \"title\": \"CVE Program Container\"}, {\"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 9, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"CHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"version\": \"3.1\"}}, {\"other\": {\"content\": {\"id\": \"CVE-2021-40438\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2021-10-14T00:00:00+00:00\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2021-12-01\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40438\"}, \"type\": \"kev\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-08-06T03:55:20.326Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40438\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \"Apache HTTP Server\", \"vendor\": \"Apache Software Foundation\", \"versions\": [{\"lessThanOrEqual\": \"2.4.48\", \"status\": \"affected\", \"version\": \"Apache HTTP Server 2.4\", \"versionType\": \"custom\"}]}], \"credits\": [{\"lang\": \"en\", \"value\": \"The issue was discovered by the Apache HTTP security team while analysing CVE-2021-36160\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.\"}], \"metrics\": [{\"other\": {\"content\": {\"other\": \"high\"}, \"type\": \"unknown\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-918\", \"description\": \"CWE-918 Server Side Request Forgery (SSRF)\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2022-08-14T01:07:57.000Z\", \"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://httpd.apache.org/security/vulnerabilities_24.html\"}, {\"name\": \"FEDORA-2021-dce7e7738e\", \"tags\": [\"vendor-advisory\", \"x_refsource_FEDORA\"], \"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/\"}, {\"name\": \"[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info\", \"tags\": [\"mailing-list\", \"x_refsource_MLIST\"], \"url\": \"https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E\"}, {\"name\": \"[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info\", \"tags\": [\"mailing-list\", \"x_refsource_MLIST\"], \"url\": \"https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E\"}, {\"name\": \"[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info\", \"tags\": [\"mailing-list\", \"x_refsource_MLIST\"], \"url\": \"https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E\"}, {\"name\": \"[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info\", \"tags\": [\"mailing-list\", \"x_refsource_MLIST\"], \"url\": \"https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E\"}, {\"name\": \"FEDORA-2021-e3f6dd670d\", \"tags\": [\"vendor-advisory\", \"x_refsource_FEDORA\"], \"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/\"}, {\"name\": \"[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update\", \"tags\": [\"mailing-list\", \"x_refsource_MLIST\"], \"url\": \"https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html\"}, {\"name\": \"[httpd-bugs] 20211008 [Bug 65616] CVE-2021-36160 regression\", \"tags\": [\"mailing-list\", \"x_refsource_MLIST\"], \"url\": \"https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E\"}, {\"name\": \"DSA-4982\", \"tags\": [\"vendor-advisory\", \"x_refsource_DEBIAN\"], \"url\": \"https://www.debian.org/security/2021/dsa-4982\"}, {\"name\": \"[httpd-users] 20211019 [users@httpd] Regarding CVE-2021-40438\", \"tags\": [\"mailing-list\", \"x_refsource_MLIST\"], \"url\": \"https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E\"}, {\"name\": \"[httpd-users] 20211019 Re: [users@httpd] Regarding CVE-2021-40438\", \"tags\": [\"mailing-list\", \"x_refsource_MLIST\"], \"url\": \"https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E\"}, {\"name\": \"20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021\", \"tags\": [\"vendor-advisory\", \"x_refsource_CISCO\"], \"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://www.oracle.com/security-alerts/cpujan2022.html\"}, {\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://www.tenable.com/security/tns-2021-17\"}, {\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://security.netapp.com/advisory/ntap-20211008-0004/\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://www.oracle.com/security-alerts/cpuapr2022.html\"}, {\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf\"}, {\"name\": \"GLSA-202208-20\", \"tags\": [\"vendor-advisory\", \"x_refsource_GENTOO\"], \"url\": \"https://security.gentoo.org/glsa/202208-20\"}], \"source\": {\"discovery\": \"UNKNOWN\"}, \"timeline\": [{\"lang\": \"en\", \"time\": \"2021-09-16T00:00:00.000Z\", \"value\": \"2.4.49 released\"}], \"title\": \"mod_proxy SSRF\", \"x_generator\": {\"engine\": \"Vulnogram 0.0.9\"}, \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"security@apache.org\", \"ID\": \"CVE-2021-40438\", \"STATE\": \"PUBLIC\", \"TITLE\": \"mod_proxy SSRF\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"Apache HTTP Server\", \"version\": {\"version_data\": [{\"version_affected\": \"<=\", \"version_name\": \"Apache HTTP Server 2.4\", \"version_value\": \"2.4.48\"}]}}]}, \"vendor_name\": \"Apache Software Foundation\"}]}}, \"credit\": [{\"lang\": \"eng\", \"value\": \"The issue was discovered by the Apache HTTP security team while analysing CVE-2021-36160\"}], \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.\"}]}, \"generator\": {\"engine\": \"Vulnogram 0.0.9\"}, \"impact\": [{\"other\": \"high\"}], \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-918 Server Side Request Forgery (SSRF)\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"https://httpd.apache.org/security/vulnerabilities_24.html\", \"refsource\": \"MISC\", \"url\": \"https://httpd.apache.org/security/vulnerabilities_24.html\"}, {\"name\": \"FEDORA-2021-dce7e7738e\", \"refsource\": \"FEDORA\", \"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/\"}, {\"name\": \"[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info\", \"refsource\": \"MLIST\", \"url\": \"https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E\"}, {\"name\": \"[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info\", \"refsource\": \"MLIST\", \"url\": \"https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E\"}, {\"name\": \"[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info\", \"refsource\": \"MLIST\", \"url\": \"https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E\"}, {\"name\": \"[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info\", \"refsource\": \"MLIST\", \"url\": \"https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E\"}, {\"name\": \"FEDORA-2021-e3f6dd670d\", \"refsource\": \"FEDORA\", \"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/\"}, {\"name\": \"[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update\", \"refsource\": \"MLIST\", \"url\": \"https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html\"}, {\"name\": \"[httpd-bugs] 20211008 [Bug 65616] CVE-2021-36160 regression\", \"refsource\": \"MLIST\", \"url\": \"https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E\"}, {\"name\": \"DSA-4982\", \"refsource\": \"DEBIAN\", \"url\": \"https://www.debian.org/security/2021/dsa-4982\"}, {\"name\": \"[httpd-users] 20211019 [users@httpd] Regarding CVE-2021-40438\", \"refsource\": \"MLIST\", \"url\": \"https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E\"}, {\"name\": \"[httpd-users] 20211019 Re: [users@httpd] Regarding CVE-2021-40438\", \"refsource\": \"MLIST\", \"url\": \"https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00@%3Cusers.httpd.apache.org%3E\"}, {\"name\": \"20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021\", \"refsource\": \"CISCO\", \"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ\"}, {\"name\": \"https://www.oracle.com/security-alerts/cpujan2022.html\", \"refsource\": \"MISC\", \"url\": \"https://www.oracle.com/security-alerts/cpujan2022.html\"}, {\"name\": \"https://www.tenable.com/security/tns-2021-17\", \"refsource\": \"CONFIRM\", \"url\": \"https://www.tenable.com/security/tns-2021-17\"}, {\"name\": \"https://security.netapp.com/advisory/ntap-20211008-0004/\", \"refsource\": \"CONFIRM\", \"url\": \"https://security.netapp.com/advisory/ntap-20211008-0004/\"}, {\"name\": \"https://www.oracle.com/security-alerts/cpuapr2022.html\", \"refsource\": \"MISC\", \"url\": \"https://www.oracle.com/security-alerts/cpuapr2022.html\"}, {\"name\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf\", \"refsource\": \"CONFIRM\", \"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf\"}, {\"name\": \"GLSA-202208-20\", \"refsource\": \"GENTOO\", \"url\": \"https://security.gentoo.org/glsa/202208-20\"}]}, \"source\": {\"discovery\": \"UNKNOWN\"}, \"timeline\": [{\"lang\": \"en\", \"time\": \"2021-09-16T00:00:00.000Z\", \"value\": \"2.4.49 released\"}]}}}, \"cveMetadata\": {\"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"assignerShortName\": \"apache\", \"cveId\": \"CVE-2021-40438\", \"datePublished\": \"2021-09-16T14:40:23.000Z\", \"dateReserved\": \"2021-09-02T00:00:00.000Z\", \"dateUpdated\": \"2026-08-06T03:55:20.326Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":0,"cve":"CVE-2021-40438","id":7253,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.99999, \"percentile\": 0.99997}"},{"alert":0,"cve":"CVE-2021-40438","id":5030,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.99999, \"percentile\": 0.99997}"},{"alert":0,"cve":"CVE-2021-40438","id":2812,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.99999, \"percentile\": 0.99997}"},{"alert":1,"cve":"CVE-2021-40438","id":1474,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2021-40438\", \"cwes\": [\"CWE-918\"], \"dateAdded\": \"2021-12-01\", \"dueDate\": \"2021-12-15\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Known\", \"notes\": \"https://nvd.nist.gov/vuln/detail/CVE-2021-40438\", \"product\": \"Apache\", \"requiredAction\": \"Apply updates per vendor instructions.\", \"shortDescription\": \"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.\", \"vendorProject\": \"Apache\", \"vulnerabilityName\": \"Apache HTTP Server-Side Request Forgery (SSRF)\"}"}],"record":{"affected":[{"product":"Apache HTTP Server","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.4.48","status":"affected","version":"Apache HTTP Server 2.4","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-04T02:44:10.131Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"https://httpd.apache.org/security/vulnerabilities_24.html"},{"name":"FEDORA-2021-dce7e7738e","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"},{"name":"[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E"},{"name":"[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E"},{"name":"[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E"},{"name":"[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E"},{"name":"FEDORA-2021-e3f6dd670d","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"},{"name":"[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html"},{"name":"[httpd-bugs] 20211008 [Bug 65616] CVE-2021-36160 regression","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E"},{"name":"DSA-4982","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"https://www.debian.org/security/2021/dsa-4982"},{"name":"[httpd-users] 20211019 [users@httpd] Regarding CVE-2021-40438","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E"},{"name":"[httpd-users] 20211019 Re: [users@httpd] Regarding CVE-2021-40438","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E"},{"name":"20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"],"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.oracle.com/security-alerts/cpujan2022.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://www.tenable.com/security/tns-2021-17"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://security.netapp.com/advisory/ntap-20211008-0004/"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf"},{"name":"GLSA-202208-20","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"],"url":"https://security.gentoo.org/glsa/202208-20"}],"title":"CVE Program Container"},{"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2021-40438","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2021-10-14T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2021-12-01","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40438"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2026-08-06T03:55:20.326Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40438"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"Apache HTTP Server","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.4.48","status":"affected","version":"Apache HTTP Server 2.4","versionType":"custom"}]}],"credits":[{"lang":"en","value":"The issue was discovered by the Apache HTTP security team while analysing CVE-2021-36160"}],"descriptions":[{"lang":"en","value":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier."}],"metrics":[{"other":{"content":{"other":"high"},"type":"unknown"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","description":"CWE-918 Server Side Request Forgery (SSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2022-08-14T01:07:57.000Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["x_refsource_MISC"],"url":"https://httpd.apache.org/security/vulnerabilities_24.html"},{"name":"FEDORA-2021-dce7e7738e","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"},{"name":"[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info","tags":["mailing-list","x_refsource_MLIST"],"url":"https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E"},{"name":"[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info","tags":["mailing-list","x_refsource_MLIST"],"url":"https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E"},{"name":"[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info","tags":["mailing-list","x_refsource_MLIST"],"url":"https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E"},{"name":"[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info","tags":["mailing-list","x_refsource_MLIST"],"url":"https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E"},{"name":"FEDORA-2021-e3f6dd670d","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"},{"name":"[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update","tags":["mailing-list","x_refsource_MLIST"],"url":"https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html"},{"name":"[httpd-bugs] 20211008 [Bug 65616] CVE-2021-36160 regression","tags":["mailing-list","x_refsource_MLIST"],"url":"https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E"},{"name":"DSA-4982","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"https://www.debian.org/security/2021/dsa-4982"},{"name":"[httpd-users] 20211019 [users@httpd] Regarding CVE-2021-40438","tags":["mailing-list","x_refsource_MLIST"],"url":"https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E"},{"name":"[httpd-users] 20211019 Re: [users@httpd] Regarding CVE-2021-40438","tags":["mailing-list","x_refsource_MLIST"],"url":"https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E"},{"name":"20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021","tags":["vendor-advisory","x_refsource_CISCO"],"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ"},{"tags":["x_refsource_MISC"],"url":"https://www.oracle.com/security-alerts/cpujan2022.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://www.tenable.com/security/tns-2021-17"},{"tags":["x_refsource_CONFIRM"],"url":"https://security.netapp.com/advisory/ntap-20211008-0004/"},{"tags":["x_refsource_MISC"],"url":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf"},{"name":"GLSA-202208-20","tags":["vendor-advisory","x_refsource_GENTOO"],"url":"https://security.gentoo.org/glsa/202208-20"}],"source":{"discovery":"UNKNOWN"},"timeline":[{"lang":"en","time":"2021-09-16T00:00:00.000Z","value":"2.4.49 released"}],"title":"mod_proxy SSRF","x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@apache.org","ID":"CVE-2021-40438","STATE":"PUBLIC","TITLE":"mod_proxy SSRF"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Apache HTTP Server","version":{"version_data":[{"version_affected":"<=","version_name":"Apache HTTP Server 2.4","version_value":"2.4.48"}]}}]},"vendor_name":"Apache Software Foundation"}]}},"credit":[{"lang":"eng","value":"The issue was discovered by the Apache HTTP security team while analysing CVE-2021-36160"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":[{"other":"high"}],"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-918 Server Side Request Forgery (SSRF)"}]}]},"references":{"reference_data":[{"name":"https://httpd.apache.org/security/vulnerabilities_24.html","refsource":"MISC","url":"https://httpd.apache.org/security/vulnerabilities_24.html"},{"name":"FEDORA-2021-dce7e7738e","refsource":"FEDORA","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"},{"name":"[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info","refsource":"MLIST","url":"https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E"},{"name":"[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info","refsource":"MLIST","url":"https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E"},{"name":"[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info","refsource":"MLIST","url":"https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E"},{"name":"[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info","refsource":"MLIST","url":"https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E"},{"name":"FEDORA-2021-e3f6dd670d","refsource":"FEDORA","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"},{"name":"[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update","refsource":"MLIST","url":"https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html"},{"name":"[httpd-bugs] 20211008 [Bug 65616] CVE-2021-36160 regression","refsource":"MLIST","url":"https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E"},{"name":"DSA-4982","refsource":"DEBIAN","url":"https://www.debian.org/security/2021/dsa-4982"},{"name":"[httpd-users] 20211019 [users@httpd] Regarding CVE-2021-40438","refsource":"MLIST","url":"https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E"},{"name":"[httpd-users] 20211019 Re: [users@httpd] Regarding CVE-2021-40438","refsource":"MLIST","url":"https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00@%3Cusers.httpd.apache.org%3E"},{"name":"20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021","refsource":"CISCO","url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ"},{"name":"https://www.oracle.com/security-alerts/cpujan2022.html","refsource":"MISC","url":"https://www.oracle.com/security-alerts/cpujan2022.html"},{"name":"https://www.tenable.com/security/tns-2021-17","refsource":"CONFIRM","url":"https://www.tenable.com/security/tns-2021-17"},{"name":"https://security.netapp.com/advisory/ntap-20211008-0004/","refsource":"CONFIRM","url":"https://security.netapp.com/advisory/ntap-20211008-0004/"},{"name":"https://www.oracle.com/security-alerts/cpuapr2022.html","refsource":"MISC","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"name":"https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf","refsource":"CONFIRM","url":"https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf"},{"name":"GLSA-202208-20","refsource":"GENTOO","url":"https://security.gentoo.org/glsa/202208-20"}]},"source":{"discovery":"UNKNOWN"},"timeline":[{"lang":"en","time":"2021-09-16T00:00:00.000Z","value":"2.4.49 released"}]}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2021-40438","datePublished":"2021-09-16T14:40:23.000Z","dateReserved":"2021-09-02T00:00:00.000Z","dateUpdated":"2026-08-06T03:55:20.326Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794349204,"cve":"CVE-2021-40438","description":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","epss":{"date":"2026-11-12","epss":0.99999,"percentile":0.99997},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2021-40438","cwes":["CWE-918"],"dateAdded":"2021-12-01","dueDate":"2021-12-15","forensicTriage":"No","knownRansomwareCampaignUse":"Known","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-40438","product":"Apache","requiredAction":"Apply updates per vendor instructions.","shortDescription":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","vendorProject":"Apache","vulnerabilityName":"Apache HTTP Server-Side Request Forgery (SSRF)"},"kev_checked":1794522003,"products":"Apache Software Foundation Apache HTTP Server","references":["https://httpd.apache.org/security/vulnerabilities_24.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/","https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E","https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E","https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E","https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/","https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html","https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E","https://www.debian.org/security/2021/dsa-4982","https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E","https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.tenable.com/security/tns-2021-17","https://security.netapp.com/advisory/ntap-20211008-0004/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf","https://security.gentoo.org/glsa/202208-20","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40438"],"score":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"CISA-ADP","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"mod_proxy SSRF","updated_at":1794500401,"workarounds":""},"sources":[]}