CVE-2024-38476

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Score

CVSS 3.1 9.8 Critical

Status

Modified - security@apache.org

Published

2024-07-01

Last modified

2025-11-03

Weaknesses

CWE-829

Affected products

• Http Server (Apache)
• Apache Http Server (Apache Software Foundation)
• Clustered Data Ontap (Netapp)

References

• https://httpd.apache.org/security/vulnerabilities_24.html
• https://security.netapp.com/advisory/ntap-20240712-0001/
• http://seclists.org/fulldisclosure/2024/Oct/11
• http://www.openwall.com/lists/oss-security/2024/07/01/9