CVE-2024-38476

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.

Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-829

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache HTTP Server	>= 2.4.0, <= 2.4.59
apache	http_server	<= 2.4.59

References

https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
https://security.netapp.com/advisory/ntap-20240712-0001/Third Party Advisory
http://seclists.org/fulldisclosure/2024/Oct/11
http://www.openwall.com/lists/oss-security/2024/07/01/9Mailing List, Third Party Advisory
https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
https://security.netapp.com/advisory/ntap-20240712-0001/Third Party Advisory

Timeline

Published: Jul 1, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-384777.5null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious reques CVE-2024-384797.5Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from CVE-2024-38487.5A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. Th CVE-2024-384804.0"Piccoma" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attack CVE-2024-384814.4Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Read Vulnerability. A privileged local attacker could execute ar CVE-2024-384827.2CloudLink, versions 7.1.x and 8.x, contain an Improper check or handling of Exceptional Conditions Vulnerability in Cluster Component. A hig CVE-2024-384836.7Dell BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local ac CVE-2024-384854.3Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially expl CVE-2024-384868.8Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x , contain(s) an Improper Neutralization of Special Elemen CVE-2024-384877.0api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintend CVE-2024-384889.8Dell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. An improper Restriction of Excessive Authentication vulnerability whe CVE-2024-384894.4Dell iDRAC Service Module version 5.3.0.0 and prior contains Out of bound write Vulnerability. A privileged local attacker could execute arb