Skip to main content
Scan free
CVE Radar
Critical Actively ExploitedApache

CVE-2021-40438

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

CVSS Base Score
9.0

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploit Probability
100%EPSS PERCENTILE0100

More exploitable than 100% of all CVEs · Top 0%

Is your site exposed to this?

Run a free scan. UNPWNED fingerprints your stack and flags this CVE class if the affected technology is detected.

Check my site
Details
Published
2021-09-16
Last modified
2026-08-01
Added to CISA KEV
2021-12-01
Affected
Apache
References
NVD Detail OSV.dev GitHub Advisories

Related exploited CVEs in Apache

CVE-2026-23918
High · 8.8 CVSSApache
CVE-2026-49975
High · 7.5 CVSSApache
CVE-2009-3720
Medium · 5 CVSSApache

Data from the National Vulnerability Database (NVD), CISA KEV, and FIRST.org EPSS. This product uses the NVD API but is not endorsed or certified by the NVD. EPSS is a probability estimate, not a guarantee of exploitation.