QSearchQSearch

CVE-2021-40438

9.0 CRITICAL

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user

Published: 2021-09-16 · Last updated: 2026-06-17

Severity and scoring

CVSS
9.0 CRITICAL
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE
CWE-918

Affected products

VendorProduct
apachebrocade_fabric_operating_system_firmware, cloud_backup, clustered_data_ontap
broadcombrocade_fabric_operating_system_firmware, cloud_backup, clustered_data_ontap
debianbrocade_fabric_operating_system_firmware, cloud_backup, clustered_data_ontap
f5brocade_fabric_operating_system_firmware, cloud_backup, clustered_data_ontap
fedoraprojectbrocade_fabric_operating_system_firmware, cloud_backup, clustered_data_ontap
netappbrocade_fabric_operating_system_firmware, cloud_backup, clustered_data_ontap
oraclebrocade_fabric_operating_system_firmware, cloud_backup, clustered_data_ontap
redhatbrocade_fabric_operating_system_firmware, cloud_backup, clustered_data_ontap
resfbrocade_fabric_operating_system_firmware, cloud_backup, clustered_data_ontap
siemensbrocade_fabric_operating_system_firmware, cloud_backup, clustered_data_ontap
tenablebrocade_fabric_operating_system_firmware, cloud_backup, clustered_data_ontap

Description

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-1767 — A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` component (5.6 MEDIUM)
  • CVE-2026-1766 — A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 com... (5.6 MEDIUM)
  • CVE-2026-50645 — There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can l... (7.5 HIGH)
  • CVE-2026-50634 — A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticate... (6.5 MEDIUM)
  • CVE-2026-50633 — A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an atta... (8.1 HIGH)

Same CWE

  • CVE-2026-53859 — OpenClaw before 2026.5.26 contains a hostname validation vulnerability allowing attackers to bypass blocklist comparisons using trailing-... (6.5 MEDIUM)
  • CVE-2026-47684 — Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing (7.7 HIGH)
  • CVE-2025-60175 — Administrator Server Side Request Forgery (SSRF) in PopAd <= 1.0.4 versions (4.4 MEDIUM)
  • CVE-2026-50888 — An authenticated Server-Side Request Forgery (SSRF) in the custom scraper subsystem component of Benjamin Jonard Koillection v1.8.0 allow... (8.1 HIGH)
  • CVE-2026-50887 — A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan inte... (9.1 CRITICAL)