Updated: 2025-12-14 02:18:19.295145
Description:
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
| Links | NIST | CIRCL | RHEL | Ubuntu |
| Severity | Score | |
|---|---|---|
| CVSS Version 2.x | MEDIUM | 6.8 |
| CVSS Version 3.x | CRITICAL | 9.0 |
| Added Date | Description | Due Date | Notes |
|---|---|---|---|
| 2021-12-01 | A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. | 2021-12-15 | https://nvd.nist.gov/vuln/detail/CVE-2021-40438 |
| OS name | Project name | Version | Score | Severity | Status | Errata | Last updated | Statement |
|---|---|---|---|---|---|---|---|---|
| Ubuntu 16.04 ELS | apache2 | 2.4.18 | 9.0 | CRITICAL | Released | CLSA-2021:1635458969 | 2022-04-19 21:49:45 | Our resolution: https://bit.ly/3EAaIV6 |
| Ubuntu 18.04 ELS | apache2 | 2.4.29 | 9.0 | CRITICAL | Already Fixed | 2023-04-28 08:48:56 | Our resolution: https://bit.ly/3EAaIV6 |