CVE-2021-40438

CriticalCVSS 9.0/10Known exploited (CISA KEV)Last modified Aug 6, 2026

Description

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Sep 16, 2021
Last modified
Aug 6, 2026
Added to CISA KEV
Dec 1, 2021
NVD status
Analyzed

Related CVEs from 2021

CVE-2021-404396.5Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansCVE-2021-40447.5Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may retCVE-2021-404405.4Microsoft Dynamics Business Central Cross-site Scripting VulnerabilityCVE-2021-404417.8Windows Media Center Elevation of Privilege VulnerabilityCVE-2021-404427.8Microsoft Excel Remote Code Execution VulnerabilityCVE-2021-404437.8Windows Common Log File System Driver Elevation of Privilege VulnerabilityCVE-2021-404448.8Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of CVE-2021-404477.8Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2021-404486.3Microsoft Accessibility Insights for Android Information Disclosure VulnerabilityCVE-2021-404497.8Win32k Elevation of Privilege VulnerabilityCVE-2021-40459.8TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uCVE-2021-404507.8Win32k Elevation of Privilege Vulnerability
CVE-2021-40438: Critical severity, CVSS 9.0 | Vulnix