Is CVE-2021-40438 actively exploited?

CVE-2021-40438 has no public evidence of in-the-wild exploitation as of 2025-10-27.

What is the CVSS score for CVE-2021-40438?

CVE-2021-40438 has a CVSS score of 9 (CRITICAL severity). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.

How do I patch CVE-2021-40438?

Patch guidance is available from resf security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2021-40438.

Fix CVE-2021-40438 - CRITICAL resf rocky linux

Q: Which products are affected by CVE-2021-40438?

83 products: resf rocky linux, redhat enterprise linux, redhat enterprise linux eus, redhat enterprise linux eus, redhat enterprise linux eus, and 78 more.

Description

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector: network
Complexity: high
Privileges: none
User Action: none
Scope: changed
Confidentiality: high
Integrity: high
Availability: high
Weaknesses: CWE-918 · Server-Side Request Forgery CWE-918 · Server-Side Request Forgery

Metadata

Primary Vendor: RESF
Published: 9/16/2021
Last Modified: 10/27/2025
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

resf : rocky_linuxredhat : enterprise_linuxredhat : enterprise_linux_eusredhat : enterprise_linux_eusredhat : enterprise_linux_eusredhat : enterprise_linux_eusredhat : enterprise_linux_eusredhat : enterprise_linux_for_arm_64redhat : enterprise_linux_for_arm_64_eusredhat : enterprise_linux_for_arm_64_eusredhat : enterprise_linux_for_ibm_z_systemsredhat : enterprise_linux_for_ibm_z_systemsredhat : enterprise_linux_for_ibm_z_systems_eusredhat : enterprise_linux_for_ibm_z_systems_eusredhat : enterprise_linux_for_ibm_z_systems_eusredhat : enterprise_linux_for_ibm_z_systems_eus_s390xredhat : enterprise_linux_for_power_big_endianredhat : enterprise_linux_for_power_little_endianredhat : enterprise_linux_for_power_little_endianredhat : enterprise_linux_for_power_little_endian_eusredhat : enterprise_linux_for_power_little_endian_eusredhat : enterprise_linux_for_power_little_endian_eusredhat : enterprise_linux_for_power_little_endian_eusredhat : enterprise_linux_for_power_little_endian_eusredhat : enterprise_linux_for_scientific_computingredhat : enterprise_linux_serverredhat : enterprise_linux_server_ausredhat : enterprise_linux_server_ausredhat : enterprise_linux_server_ausredhat : enterprise_linux_server_ausredhat : enterprise_linux_server_ausredhat : enterprise_linux_server_ausredhat : enterprise_linux_server_ausredhat : enterprise_linux_server_ausredhat : enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsredhat : enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsredhat : enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsredhat : enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsredhat : enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsredhat : enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsredhat : enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsredhat : enterprise_linux_server_tusredhat : enterprise_linux_server_tusredhat : enterprise_linux_server_tusredhat : enterprise_linux_server_tusredhat : enterprise_linux_server_tusredhat : enterprise_linux_server_tusredhat : enterprise_linux_server_update_services_for_sap_solutionsredhat : enterprise_linux_server_update_services_for_sap_solutionsredhat : enterprise_linux_update_services_for_sap_solutionsredhat : enterprise_linux_update_services_for_sap_solutionsredhat : enterprise_linux_update_services_for_sap_solutionsredhat : enterprise_linux_update_services_for_sap_solutionsredhat : enterprise_linux_update_services_for_sap_solutionsredhat : enterprise_linux_workstationredhat : jboss_core_servicesredhat : software_collectionsapache : http_serverfedoraproject : fedorafedoraproject : fedoradebian : debian_linuxdebian : debian_linuxdebian : debian_linuxnetapp : cloud_backupnetapp : clustered_data_ontapnetapp : storagegridbroadcom : brocade_fabric_operating_system_firmwaref5 : f5osf5 : f5osoracle : enterprise_manager_ops_centeroracle : http_serveroracle : http_serveroracle : instantis_enterprisetrackoracle : instantis_enterprisetrackoracle : instantis_enterprisetrackoracle : secure_global_desktoporacle : zfs_storage_appliance_kitsiemens : ruggedcom_nmssiemens : sinec_nmssiemens : sinema_remote_connect_serversiemens : sinema_remote_connect_serversiemens : sinema_servertenable : tenable.sc

Remediation Guidance

Executive Summary

View on NIST NVD