Vulnary
← back to the feed
Critical· 9actively exploitedofficial fix available

CVE-2021-40438

A critical vulnerability in Apache HTTP Server allows attackers to craft a request that causes the server to forward traffic to an arbitrary origin server chosen by the attacker. This can lead to data leakage, unauthorized access, or other malicious actions. The issue affects Apache 2.4.48 and earlier, and is present in many Linux distributions.

publishedSep 16, 2021
last modifiedAug 6, 2026
sourcesNVD · CISA-KEV
severity · cvss
9
critical · how bad it is
exploitation · epss
100%
100th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 31, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

01

Who is affected

Apache HTTP Server 2.4.48 and earlier, used on various Linux distributions such as Red Hat Enterprise Linux, Rocky Linux, and IBM Z systems.

02

Real-world impact

An attacker could redirect traffic to a malicious server, potentially exposing sensitive data, executing unauthorized commands, or facilitating further attacks.

03

Why this severity

The CVSS score of 9 reflects the high impact on confidentiality, integrity, and availability, combined with the fact that the vulnerability can be exploited remotely without authentication or user interaction.

04

What to do about it

official fix available
recommended steps
  1. 01Update Apache HTTP Server to a version newer than 2.4.48 following vendor instructions.

CISA KEV required action

05

Timeline

  1. Sep 16, 2021 · Sep 16, 2021
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Dec 1, 2021 · Dec 1, 2021
    Confirmed exploited (CISA KEV)
    CISA added it to the Known Exploited Vulnerabilities catalog — attackers are using it in the wild.
  3. Dec 15, 2021 · Dec 15, 2021
    CISA remediation deadline
    Federal agencies are required to remediate by this date.
  4. Aug 1, 2026 · 5d ago
    Official fix available
    A vendor patch or mitigation now exists — see the remediation steps above.
  5. Aug 6, 2026 · 4h ago
    Advisory updated
    The NVD record was last revised.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityHigh
Privileges requiredNone
User interactionNone needed
ScopeChanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

NVD advisory ↗CISA KEV catalog ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →