Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
Priority CRITICAL 98Exploited in the wildCWE-116Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
Why it matters now
Exploitation Active In CISA KEV since 2025-05-01CISA due date 2025-05-22
EPSS 0.99957 99th percentileScored 2026-11-07
Fix Fixed Red Hat: 12 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache HTTP Server | 2.4.0 – 2.4.59 | — | No fix listed | CNA |
- Apache HTTP Server VendorApache Affected 2.4.0 – 2.4.59 Fixed in — No fix listed CNA
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | 2.4.0 to before 2.4.60 | Vulnerable | Apache |
| cpe:2.3:a:netapp:ontap_9:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:sonicwall:sma_200_firmware:*:*:*:*:*:*:*:* | before 10.2.1.14-75sv | Vulnerable | SonicWall |
| cpe:2.3:h:sonicwall:sma_200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SonicWall |
| cpe:2.3:o:sonicwall:sma_210_firmware:*:*:*:*:*:*:*:* | before 10.2.1.14-75sv | Vulnerable | SonicWall |
| cpe:2.3:h:sonicwall:sma_210:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SonicWall |
| cpe:2.3:o:sonicwall:sma_400_firmware:*:*:*:*:*:*:*:* | before 10.2.1.14-75sv | Vulnerable | SonicWall |
| cpe:2.3:h:sonicwall:sma_400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SonicWall |
| cpe:2.3:o:sonicwall:sma_410_firmware:*:*:*:*:*:*:*:* | before 10.2.1.14-75sv | Vulnerable | SonicWall |
| cpe:2.3:h:sonicwall:sma_410:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SonicWall |
- cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* Versions 2.4.0 to before 2.4.60 Vulnerable ·Apache
- cpe:2.3:a:netapp:ontap_9:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:sonicwall:sma_200_firmware:*:*:*:*:*:*:*:* Versions before 10.2.1.14-75sv Vulnerable ·SonicWall
- cpe:2.3:h:sonicwall:sma_200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SonicWall
- cpe:2.3:o:sonicwall:sma_210_firmware:*:*:*:*:*:*:*:* Versions before 10.2.1.14-75sv Vulnerable ·SonicWall
- cpe:2.3:h:sonicwall:sma_210:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SonicWall
- cpe:2.3:o:sonicwall:sma_400_firmware:*:*:*:*:*:*:*:* Versions before 10.2.1.14-75sv Vulnerable ·SonicWall
- cpe:2.3:h:sonicwall:sma_400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SonicWall
- cpe:2.3:o:sonicwall:sma_410_firmware:*:*:*:*:*:*:*:* Versions before 10.2.1.14-75sv Vulnerable ·SonicWall
- cpe:2.3:h:sonicwall:sma_410:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SonicWall
Remediation
Red Hat 12 advisories
- RHSA-2024:5239 Released 2024-08-13 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.57 SP5 security update
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-httpd-2.4.57-13.el7jbcs, jbcs-httpd24-httpd-devel-2.4.57-13.el7jbcs, jbcs-httpd24-httpd-manual-2.4.57-13.el7jbcs +12
- Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-httpd-2.4.57-13.el8jbcs, jbcs-httpd24-httpd-devel-2.4.57-13.el8jbcs, jbcs-httpd24-httpd-manual-2.4.57-13.el8jbcs +12
- RHSA-2024:5240 Released 2024-08-13 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.57 SP5 security update
- Red Hat JBoss Core Services
- RHSA-2024:4943 Released 2024-07-31 · Red Hat rating Importanthttpd security update
- Red Hat Enterprise Linux Server (v. 7 ELS) httpd-2.4.6-99.el7_9.2, httpd-devel-2.4.6-99.el7_9.2, httpd-manual-2.4.6-99.el7_9.2 +3
- Red Hat Enterprise Linux Server Optional (v. 7 ELS) mod_ldap-2.4.6-99.el7_9.2, mod_proxy_html-1:2.4.6-99.el7_9.2
Show 9 more Red Hat advisories
- RHSA-2024:4938 Released 2024-07-31 · Red Hat rating Importanthttpd security update
- Red Hat Enterprise Linux Server AUS (v. 7.7) httpd-2.4.6-90.el7_7.4, httpd-devel-2.4.6-90.el7_7.4, httpd-manual-2.4.6-90.el7_7.4 +3
- Red Hat Enterprise Linux Server Optional AUS (v. 7.7) mod_ldap-2.4.6-90.el7_7.4, mod_proxy_html-1:2.4.6-90.el7_7.4
- RHSA-2024:4862 Released 2024-07-25 · Red Hat rating Importanthttpd security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) httpd-2.4.53-11.el9_2.8, httpd-core-2.4.53-11.el9_2.8, httpd-devel-2.4.53-11.el9_2.8 +8
- RHSA-2024:4863 Released 2024-07-25 · Red Hat rating Importanthttpd security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) httpd-2.4.51-7.el9_0.7, httpd-devel-2.4.51-7.el9_0.7, httpd-filesystem-2.4.51-7.el9_0.7 +7
- RHSA-2024:4830 Released 2024-07-24 · Red Hat rating Importanthttpd:2.4 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) httpd-2.4.37-39.module+el8.4.0+22127+467cc488.8.src::httpd:2.4, httpd-2.4.37-39.module+el8.4.0+22127+467cc488.8.x86_64::httpd:2.4, httpd-devel-2.4.37-39.module+el8.4.0+22127+467cc488.8.x86_64::httpd:2.4 +11
- Red Hat Enterprise Linux AppStream E4S (v.8.4) httpd-2.4.37-39.module+el8.4.0+22127+467cc488.8.ppc64le::httpd:2.4, httpd-2.4.37-39.module+el8.4.0+22127+467cc488.8.src::httpd:2.4, httpd-2.4.37-39.module+el8.4.0+22127+467cc488.8.x86_64::httpd:2.4 +20
- Red Hat Enterprise Linux AppStream TUS (v.8.4) httpd-2.4.37-39.module+el8.4.0+22127+467cc488.8.src::httpd:2.4, httpd-2.4.37-39.module+el8.4.0+22127+467cc488.8.x86_64::httpd:2.4, httpd-devel-2.4.37-39.module+el8.4.0+22127+467cc488.8.x86_64::httpd:2.4 +11
- RHSA-2024:4827 Released 2024-07-24 · Red Hat rating Importanthttpd:2.4 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) httpd-2.4.37-47.module+el8.6.0+22124+21ed7001.9.src::httpd:2.4, httpd-2.4.37-47.module+el8.6.0+22124+21ed7001.9.x86_64::httpd:2.4, httpd-devel-2.4.37-47.module+el8.6.0+22124+21ed7001.9.x86_64::httpd:2.4 +11
- Red Hat Enterprise Linux AppStream E4S (v.8.6) httpd-2.4.37-47.module+el8.6.0+22124+21ed7001.9.aarch64::httpd:2.4, httpd-2.4.37-47.module+el8.6.0+22124+21ed7001.9.ppc64le::httpd:2.4, httpd-2.4.37-47.module+el8.6.0+22124+21ed7001.9.s390x::httpd:2.4 +38
- Red Hat Enterprise Linux AppStream TUS (v.8.6) httpd-2.4.37-47.module+el8.6.0+22124+21ed7001.9.src::httpd:2.4, httpd-2.4.37-47.module+el8.6.0+22124+21ed7001.9.x86_64::httpd:2.4, httpd-devel-2.4.37-47.module+el8.6.0+22124+21ed7001.9.x86_64::httpd:2.4 +11
- RHSA-2024:4820 Released 2024-07-24 · Red Hat rating Importanthttpd:2.4 security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) httpd-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.src::httpd:2.4, httpd-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.x86_64::httpd:2.4, httpd-devel-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.x86_64::httpd:2.4 +11
- RHSA-2024:4726 Released 2024-07-23 · Red Hat rating Importanthttpd security update
- Red Hat Enterprise Linux AppStream (v. 9) httpd-2.4.57-11.el9_4, httpd-core-2.4.57-11.el9_4, httpd-devel-2.4.57-11.el9_4 +8
- RHSA-2024:4719 Released 2024-07-23 · Red Hat rating Importanthttpd:2.4 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) httpd-2.4.37-56.module+el8.8.0+22079+e03f6970.8.aarch64::httpd:2.4, httpd-2.4.37-56.module+el8.8.0+22079+e03f6970.8.ppc64le::httpd:2.4, httpd-2.4.37-56.module+el8.8.0+22079+e03f6970.8.s390x::httpd:2.4 +38
- RHSA-2024:4720 Released 2024-07-23 · Red Hat rating Importanthttpd:2.4 security update
- Red Hat Enterprise Linux AppStream (v. 8) httpd-2.4.37-65.module+el8.10.0+22069+b47f5c72.1.aarch64::httpd:2.4, httpd-2.4.37-65.module+el8.10.0+22069+b47f5c72.1.ppc64le::httpd:2.4, httpd-2.4.37-65.module+el8.10.0+22069+b47f5c72.1.s390x::httpd:2.4 +38
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:4720 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:4726 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2024:4820 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2024:4830 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2024:4827 |
| Red Hat Enterprise Linux AppStream E4S (v.8.4) | Fixed | RHSA-2024:4830 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2024:4827 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2024:4863 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:4719 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2024:4862 |
| Red Hat Enterprise Linux AppStream TUS (v.8.4) | Fixed | RHSA-2024:4830 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2024:4827 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2024:4943 |
| Red Hat Enterprise Linux Server AUS (v. 7.7) | Fixed | RHSA-2024:4938 |
| Red Hat Enterprise Linux Server Optional (v. 7 ELS) | Fixed | RHSA-2024:4943 |
| Red Hat Enterprise Linux Server Optional AUS (v. 7.7) | Fixed | RHSA-2024:4938 |
| Red Hat JBoss Core Services | Fixed | RHSA-2024:5240 |
| Red Hat JBoss Core Services on RHEL 7 Server | Fixed | RHSA-2024:5239 |
| Red Hat JBoss Core Services on RHEL 8 | Fixed | RHSA-2024:5239 |
Not affected: 2 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
Timeline
- 2025-05-01 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2024-38475
- 2026-10-03 Alias added: GHSA-pf44-j75v-mhr8
- 2026-10-09 Fix available: RHSA-2024:5240 · Red Hat
- 2026-11-05 Fix available: Red Hat JBoss Core Services · Red Hat
References
Advisory 6
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://security.netapp.com/advisory/ntap-20240712-0001/
- http://www.openwall.com/lists/oss-security/2024/07/01/8
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018
- https://www.blackhat.com/us-24/briefings/schedule/index.html#confusion-attacks-exploiting-hidden-semantic-ambiguity-in-apache-http-server-pre-recorded-40227
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38475
More Apache Http Server vulnerabilities
- TI-2021-18535 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) KEVCVSS 3.1CRITICAL 9.8
- TI-2021-18417 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 KEVCVSS 3.1CRITICAL 9.8
- TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
- TI-2019-00184 Use after free in Apache HTTP Server KEVCVSS 3.1HIGH 7.8
- TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
- TI-2023-10967 Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy CVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-38475 · CVE Program
- CVE-2024-38475 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-pf44-j75v-mhr8 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-38475 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences