CVE-2021-40438

Confirmed PUBLISHED

mod_proxy SSRF

Apache Software Foundation · Apache HTTP Server

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

9.0 Critical EPSS 100.0%

At a Glance

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

apache nuclei_scanner cisa

CVE Published: Sep 16, 2021
Exploitation Reported: Dec 01, 2021
CVSS: 9.0 Critical
EPSS: 100.0%

Remote No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Apache Software Foundation	Apache HTTP Server	Apache HTTP Server 2.4 to <= 2.4.48	Affected

CVE References

FEDORA-2021-dce7e7738e lists.fedoraproject.org · Vendor Advisory https://lists.fedoraproject.org/archives/list/package-announce%40list...
FEDORA-2021-e3f6dd670d lists.fedoraproject.org · Vendor Advisory https://lists.fedoraproject.org/archives/list/package-announce%40list...
DSA-4982 debian.org · Vendor Advisory https://www.debian.org/security/2021/dsa-4982
20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021 tools.cisco.com · Vendor Advisory https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory...
GLSA-202208-20 security.gentoo.org · Vendor Advisory https://security.gentoo.org/glsa/202208-20

Show 14 more references

[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info lists.apache.org · Mailing List https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b7157...
[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info lists.apache.org · Mailing List https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3e...
[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info lists.apache.org · Mailing List https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753...
[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info lists.apache.org · Mailing List https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c...
[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update lists.debian.org · Mailing List https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
[httpd-bugs] 20211008 [Bug 65616] CVE-2021-36160 regression lists.apache.org · Mailing List https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c...
[httpd-users] 20211019 [users@httpd] Regarding CVE-2021-40438 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4...
[httpd-users] 20211019 Re: [users@httpd] Regarding CVE-2021-40438 lists.apache.org · Mailing List https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a...
httpd.apache.org/security/vulnerabilities_24.html httpd.apache.org · CVE Record https://httpd.apache.org/security/vulnerabilities_24.html
oracle.com/security-alerts/cpujan2022.html oracle.com · CVE Record https://www.oracle.com/security-alerts/cpujan2022.html
tenable.com/security/tns-2021-17 tenable.com · CVE Record https://www.tenable.com/security/tns-2021-17
security.netapp.com/advisory/ntap-20211008-0004 security.netapp.com · CVE Record https://security.netapp.com/advisory/ntap-20211008-0004/
oracle.com/security-alerts/cpuapr2022.html oracle.com · CVE Record https://www.oracle.com/security-alerts/cpuapr2022.html
cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf cert-portal.siemens.com · CVE Record https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2021-12-01 00:00 UTC
The Shadowserver	2026-05-30 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40438.yaml	Apr 25, 2025

CVSS Scores

CVSS v3.1 9.0 Critical

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0 6.8 Medium

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitation Status

Exploited in the wild

Recorded 2021-12-01 00:00:00 UTC · CISA

Proof of concept available

Recorded 2021-10-18 02:02:43 UTC · GitHub

Weaknesses (CWE)

CWE-918

Server-Side Request Forgery (SSRF)

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40438.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

sergiovks/CVE-2021-40438-Apache-2.4.48-SSRF-exploit

github · Created 2023-12-12 11:56:23 UTC · 7 stars

CVE-2021-40438 Apache <= 2.4.48 SSRF exploit

gassara-kys/CVE-2021-40438

github · Created 2022-06-10 00:46:58 UTC · 1 stars

check CVE-2021-40438

Kashkovsky/CVE-2021-40438

github · Created 2022-04-03 15:24:24 UTC · 17 stars

Apache forward request CVE

BabyTeam1024/CVE-2021-40438

github · Created 2021-10-28 11:48:12 UTC · 2 stars

sixpacksecurity/CVE-2021-40438

github · Created 2021-10-24 10:18:08 UTC · 12 stars

CVE-2021-40438 exploit PoC with Docker setup.

xiaojiangxl/CVE-2021-40438

github · Created 2021-10-18 02:02:43 UTC · 4 stars

Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery

nuclei · Created Unknown

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2021-40438

{
  "cve_id": "CVE-2021-40438",
  "title": "mod_proxy SSRF",
  "affected_vendor": "Apache Software Foundation",
  "affected_product": "Apache HTTP Server",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.0,
  "epss_score": 0.99999,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2021-40438

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API