CVE-2024-40898

Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows

7.5 HighPublic exploitFix available

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.

Users are recommended to upgrade to version 2.4.62 which fixes this issue.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

1.63%Up 1.6 points since Jul 19, 2024

What each source reports

NVD Score used 7.5

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.

Users are recommended to upgrade to version 2.4.62 which fixes this issue.

Record: CVE-2024-40898
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-918
Updated: 2026-11-02

CVE List 9.1

Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.

Users are recommended to upgrade to version 2.4.62 which fixes this issue.

Record: CVE-2024-40898
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-918
Updated: 2026-11-02

EUVDEUVD-2024-38709 9.1

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.

Users are recommended to upgrade to version 2.4.62 which fixes this issue.

Record: EUVD-2024-38709
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-f6mg-hq7f-jw2j 9.1

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to...

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.

Users are recommended to upgrade to version 2.4.62 which fixes this issue.

Record: GHSA-f6mg-hq7f-jw2j
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSVALPINE-CVE-2024-40898 7.5

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.

Users are recommended to upgrade to version 2.4.62 which fixes this issue.

Record: ALPINE-CVE-2024-40898
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSV 9.1

Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.

Users are recommended to upgrade to version 2.4.62 which fixes this issue.

Record: CVE-2024-40898
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSVBIT-apache-2024-40898 No score

Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.

Users are recommended to upgrade to version 2.4.62 which fixes this issue.

Record: BIT-apache-2024-40898
Updated: 2026-11-02

OSVMGASA-2024-0272 No score

Updated apache packages fix security vulnerabilities

CVE-2024-40898: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (cve.mitre.org) SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. CVE-2024-40725: Apache HTTP Server: source code disclosure with handlers configured via AddType (cve.mitre.org) A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.

Record: MGASA-2024-0272
Updated: 2026-11-02

OSVopenSUSE-SU-2024:14245-1 No score

apache2-2.4.62-1.1 on GA media

These are all security issues fixed in the apache2-2.4.62-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:14245-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`apache2` Alpine:v3.17	before 2.4.62-r0	2.4.62-r0
`apache2` Alpine:v3.18	before 2.4.62-r0	2.4.62-r0
`apache2` Alpine:v3.19	before 2.4.62-r0	2.4.62-r0
`apache2` Alpine:v3.20	before 2.4.62-r0	2.4.62-r0
`apache2` Alpine:v3.21	before 2.4.62-r0	2.4.62-r0
`apache2` Alpine:v3.22	before 2.4.62-r0	2.4.62-r0
`apache2` Alpine:v3.23	before 2.4.62-r0	2.4.62-r0
`apache2` Alpine:v3.24	before 2.4.62-r0	2.4.62-r0
`apache` Bitnami	2.4.0 up to 2.4.62	2.4.62
`apache` Mageia:9 From an advisory covering 2 CVEs	before 2.4.62-1.mga9	2.4.62-1.mga9
`apache2` openSUSE:Tumbleweed From an advisory covering 2 CVEs	before 2.4.62-1.1	2.4.62-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	anilpatel199n/CVE-2024-40898	2025-06-14
PoC in GitHub	ForceEA001/CVE-2024-40898-SSL-Bypass-Detection	2025-06-30

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, exploits, facts
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-40898 is a high vulnerability (CVSS 7.5) in Apache Http Server, published July 18, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.63%, the 76th percentile. Fixed in apache2 2.4.62-r0.

References

Show 6 moreShow less