CVE-2021-40438: Apache HTTP Server mod_proxy SSRF via crafted URI path

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.0 critical SSRF with CISA KEV listing, known ransomware use and near-maximum EPSS probability make this an urgent patch target.

What it is

A crafted request URI path can make mod_proxy forward the request to an origin server chosen by the remote user, an SSRF flaw in Apache HTTP Server 2.4.48 and earlier. Because the server itself makes the outbound request, attackers can reach internal or otherwise unreachable services through the proxy.

Impact

An unauthenticated remote attacker can force the server to send requests to arbitrary origins, potentially reaching internal networks, cloud metadata endpoints or protected backend services and returning their responses.

Attack surface

Reachable over the network via HTTP requests to a server running mod_proxy in a reverse-proxy configuration; no authentication or user interaction is required per the CVSS vector (AV:N/PR:N/UI:N).

Exploitation

Listed in CISA KEV with a 2021-12-15 remediation due date and flagged for known ransomware campaign use; EPSS 30-day probability is 0.99999 (percentile 0.99997), indicating active exploitation is expected.

What to do

• Upgrade Apache HTTP Server to a version later than 2.4.48 per the vendor advisory.
• Apply distribution and third-party patches (Red Hat, Debian, Fedora, Oracle, NetApp, Siemens, F5) for bundled httpd packages.
• Disable or restrict mod_proxy and ProxyPass rules where reverse proxying is not required.
• Segment and firewall the httpd host so it cannot reach internal management, metadata or backend networks.
• Review proxy configuration for untrusted or overly permissive ProxyPass/ProxyPassMatch targets.

Detection

• Inspect httpd access and proxy logs for requests with unusual or attacker-controlled URI paths that trigger outbound proxying.
• Monitor outbound connections from httpd hosts to internal RFC1918, link-local or cloud metadata addresses.
• Alert on mod_proxy error and debug log entries showing requests forwarded to unexpected origin servers.
• Correlate httpd process network activity with inbound requests to identify server-initiated SSRF traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.