Log in Start free

Vulnerability · Published Jul 10, 2025 · Assigned by apache

CVE-2024-43204Apache HTTP Server: SSRF with mod_headers setting Content-Type header

High 7.5

In plain English

A high-severity server-side request forgery in Apache HTTP Server from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.9%top 39.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker.  Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request. Users are recommended to upgrade to version 2.4.64 which fixes this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20apache22.4.64-r0ALPINE-CVE-2024-43204
Alpine:v3.21apache22.4.64-r0ALPINE-CVE-2024-43204
Alpine:v3.22apache22.4.64-r0ALPINE-CVE-2024-43204
Alpine:v3.23apache22.4.64-r0ALPINE-CVE-2024-43204
Alpine:v3.24apache22.4.64-r0ALPINE-CVE-2024-43204
Debian:12apache22.4.65-1~deb12u1DEBIAN-CVE-2024-43204
Debian:13apache22.4.64-1DEBIAN-CVE-2024-43204
Debian:14apache22.4.64-1DEBIAN-CVE-2024-43204
Ubuntu:22.04:LTSapache22.4.52-1ubuntu4.15USN-7639-1
Ubuntu:22.04:LTSapache22.4.52-1ubuntu4.15UBUNTU-CVE-2024-43204
Ubuntu:24.04:LTSapache22.4.58-1ubuntu8.7UBUNTU-CVE-2024-43204
Ubuntu:24.04:LTSapache22.4.58-1ubuntu8.7USN-7639-1
Ubuntu:25.10apache22.4.64-1ubuntu2UBUNTU-CVE-2024-43204

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache HTTP Server 2.4.0 – through 2.4.63

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References