Apache HTTP Server-Side Request Forgery (SSRF)

Added to KEV
2021-12-01
Federal due date
2021-12-15
Vendor
Apache
Product
Apache
EPSS
100.0th percentile (score 0.944, as of 2026-06-08)
NVD CVSS v3.1
Ransomware use
Unknown
Upstream
https://nvd.nist.gov/vuln/detail/CVE-2021-40438

CISA short description

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Required action

Apply updates per vendor instructions.

EPSS percentile is the FIRST.org exploit-probability ranking as of the date noted above; it moves daily. CVSS reflects NVD's analysis at time of publication.