CVE-2021-40438

critical Tenable ⚠️ CISA KEV — Exploited in the Wild
CVSS v3 Base Score
9.0
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score
100.0%
Exploitation probability in 30 days
Top 0% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Confidentiality
High
Integrity
High
Availability
High
Published: September 16, 2021 (1816 days ago)
Last Modified: August 6, 2026
Vendor: Tenable
Source: NVD

⚠️ CISA Known Exploited Vulnerability

Added to KEV: 2021-12-01
Remediation Due: 2021-12-15 (⚠ 1726d overdue)
Ransomware Campaign: Known

Description

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

CWE

CWE-918

Affected Products

resf rocky linuxredhat enterprise linuxredhat enterprise linux eusredhat enterprise linux for arm 64redhat enterprise linux for arm 64 eusredhat enterprise linux for ibm z systemsredhat enterprise linux for ibm z systems eusredhat enterprise linux for ibm z systems eus s390xredhat enterprise linux for power big endianredhat enterprise linux for power little endian

References

🔗 cert-portal.siemens.com 🔗 httpd.apache.org 🔗 lists.apache.org 🔗 lists.apache.org 🔗 lists.apache.org