# CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF)

Source: https://junglewise.ai/threats/cve-2021-40438-apache-http-server-side-request-forgery-ssrf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-12-01. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2021-40438 · Severity: critical · CVSS 9 · Exploited in the wild · Published 2021-12-01

A Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server's mod_proxy module allows a remote attacker to forward requests to an arbitrary origin server via a crafted request uri-path. This flaw can lead to unauthorized access to internal systems or data exfiltration.

Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2021-40438 exploited in the wild?** Yes. CVE-2021-40438 is known to be exploited in the wild, first recorded on 1 December 2021. Treat it as urgent.

**How severe is CVE-2021-40438?** Critical severity, with a CVSS score of 9, published 1 December 2021.

**Which products and versions are affected?** Apache HTTP Server 2.4.48 and earlier.

**Is there a fix for CVE-2021-40438?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2021-40438 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2021-40438?** Check whether you run Apache. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Apache HTTP Server 2.4.48 and earlier

## Timeline

- 2021-12-01: disclosed
- 2021-12-01: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2021-12-01: exploited: Confirmed exploited in the wild per CISA KEV catalog.