Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2024-38476

critical

CVE-2024-38476

httpd: Security issues via backend applications whose response headers are malicious or exploitable

Published Modified CWE 829
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD, Bitnami. Rated lower by Red Hat (high), AlmaLinux (high), Amazon (high), Oracle (high), Rocky Linux (high), Ubuntu (medium).

Description

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Affected packages and fixed versions

SourcePackageFixed in
bitnami::Bitnami Vulnerability Databaseapache2.4.60
alma 8httpd:2.4::httpd, httpd:2.4::httpd-devel, httpd:2.4::httpd-filesystem and 8 more2.4.37-65.module_el8.10.0+3874+c2064c23.2 and 3 more
alma 9httpd, httpd-core, httpd-devel and 8 more2.4.57-11.el9_4.1 and 1 more
alpine 3.17apache22.4.60-r0
alpine 3.18apache22.4.60-r0
alpine 3.19apache22.4.60-r0
alpine 3.20apache22.4.60-r0
alpine 3.21apache22.4.60-r0
alpine 3.22apache22.4.60-r0
alpine 3.23apache22.4.60-r0
alpine 3.24apache22.4.60-r0
alpine edgeapache22.4.60-r0
Show all 171 entries from 43 sources
SourcePackageFixed in
bitnami::Bitnami Vulnerability Databaseapache2.4.60
alma 8httpd:2.4::httpd2.4.37-65.module_el8.10.0+3874+c2064c23.2
alma 8httpd:2.4::httpd-devel2.4.37-65.module_el8.10.0+3874+c2064c23.2
alma 8httpd:2.4::httpd-filesystem2.4.37-65.module_el8.10.0+3874+c2064c23.2
alma 8httpd:2.4::httpd-manual2.4.37-65.module_el8.10.0+3874+c2064c23.2
alma 8httpd:2.4::httpd-tools2.4.37-65.module_el8.10.0+3874+c2064c23.2
alma 8httpd:2.4::mod_http21.15.7-10.module_el8.10.0+3872+9b8ab21e
alma 8httpd:2.4::mod_ldap2.4.37-65.module_el8.10.0+3874+c2064c23.2
alma 8httpd:2.4::mod_md1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa
alma 8httpd:2.4::mod_proxy_html1:2.4.37-65.module_el8.10.0+3874+c2064c23.2
alma 8httpd:2.4::mod_session2.4.37-65.module_el8.10.0+3874+c2064c23.2
alma 8httpd:2.4::mod_ssl1:2.4.37-65.module_el8.10.0+3874+c2064c23.2
alma 9httpd2.4.57-11.el9_4.1
alma 9httpd-core2.4.57-11.el9_4.1
alma 9httpd-devel2.4.57-11.el9_4.1
alma 9httpd-filesystem2.4.57-11.el9_4.1
alma 9httpd-manual2.4.57-11.el9_4.1
alma 9httpd-tools2.4.57-11.el9_4.1
alma 9mod_ldap2.4.57-11.el9_4.1
alma 9mod_lua2.4.57-11.el9_4.1
alma 9mod_proxy_html1:2.4.57-11.el9_4.1
alma 9mod_session2.4.57-11.el9_4.1
alma 9mod_ssl1:2.4.57-11.el9_4.1
alpine 3.17apache22.4.60-r0
alpine 3.18apache22.4.60-r0
alpine 3.19apache22.4.60-r0
alpine 3.20apache22.4.60-r0
alpine 3.21apache22.4.60-r0
alpine 3.22apache22.4.60-r0
alpine 3.23apache22.4.60-r0
alpine 3.24apache22.4.60-r0
alpine edgeapache22.4.60-r0
amazon linux 1httpd242.4.61-1.103.amzn1
amazon linux 1httpd24-debuginfo2.4.61-1.103.amzn1
amazon linux 1httpd24-devel2.4.61-1.103.amzn1
amazon linux 1httpd24-manual2.4.61-1.103.amzn1
amazon linux 1httpd24-tools2.4.61-1.103.amzn1
amazon linux 1mod24_ldap2.4.61-1.103.amzn1
amazon linux 1mod24_md2.4.61-1.103.amzn1
amazon linux 1mod24_proxy_html1:2.4.61-1.103.amzn1
amazon linux 1mod24_session2.4.61-1.103.amzn1
amazon linux 1mod24_ssl1:2.4.61-1.103.amzn1
amazon linux 2httpd2.4.61-1.amzn2.0.1
amazon linux 2httpd-debuginfo2.4.61-1.amzn2.0.1
amazon linux 2httpd-devel2.4.61-1.amzn2.0.1
amazon linux 2httpd-filesystem2.4.61-1.amzn2.0.1
amazon linux 2httpd-manual2.4.61-1.amzn2.0.1
amazon linux 2httpd-tools2.4.61-1.amzn2.0.1
amazon linux 2mod_ldap2.4.61-1.amzn2.0.1
amazon linux 2mod_md2.4.61-1.amzn2.0.1
amazon linux 2mod_proxy_html1:2.4.61-1.amzn2.0.1
amazon linux 2mod_session2.4.61-1.amzn2.0.1
amazon linux 2mod_ssl1:2.4.61-1.amzn2.0.1
amazon linux 2023httpd2.4.61-1.amzn2023
amazon linux 2023httpd-core2.4.61-1.amzn2023
amazon linux 2023httpd-core-debuginfo2.4.61-1.amzn2023
amazon linux 2023httpd-debuginfo2.4.61-1.amzn2023
amazon linux 2023httpd-debugsource2.4.61-1.amzn2023
amazon linux 2023httpd-devel2.4.61-1.amzn2023
amazon linux 2023httpd-filesystem2.4.61-1.amzn2023
amazon linux 2023httpd-manual2.4.61-1.amzn2023
amazon linux 2023httpd-tools2.4.61-1.amzn2023
amazon linux 2023httpd-tools-debuginfo2.4.61-1.amzn2023
amazon linux 2023mod_ldap2.4.61-1.amzn2023
amazon linux 2023mod_ldap-debuginfo2.4.61-1.amzn2023
amazon linux 2023mod_lua2.4.61-1.amzn2023
amazon linux 2023mod_lua-debuginfo2.4.61-1.amzn2023
amazon linux 2023mod_proxy_html1:2.4.61-1.amzn2023
amazon linux 2023mod_proxy_html-debuginfo1:2.4.61-1.amzn2023
amazon linux 2023mod_session2.4.61-1.amzn2023
amazon linux 2023mod_session-debuginfo2.4.61-1.amzn2023
amazon linux 2023mod_ssl1:2.4.61-1.amzn2023
amazon linux 2023mod_ssl-debuginfo1:2.4.61-1.amzn2023
debian 11apache22.4.61-1~deb11u1
debian 12apache22.4.61-1~deb12u1
debian 13apache22.4.60-1
debian 14apache22.4.60-1
echoapache22.4.61-1~deb12u1
Oracle Linux 7httpd2.4.6-99.0.5.el7_9.1
Oracle Linux 7httpd-devel2.4.6-99.0.5.el7_9.1
Oracle Linux 7httpd-manual2.4.6-99.0.5.el7_9.1
Oracle Linux 7httpd-tools2.4.6-99.0.5.el7_9.1
Oracle Linux 7mod_ldap2.4.6-99.0.5.el7_9.1
Oracle Linux 7mod_proxy_html1:2.4.6-99.0.5.el7_9.1
Oracle Linux 7mod_session2.4.6-99.0.5.el7_9.1
Oracle Linux 7mod_ssl1:2.4.6-99.0.5.el7_9.1
Oracle Linux 8httpd2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2
Oracle Linux 8httpd-devel2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2
Oracle Linux 8httpd-filesystem2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2
Oracle Linux 8httpd-manual2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2
Oracle Linux 8httpd-tools2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2
Oracle Linux 8mod_http21.15.7-10.module+el8.10.0+90327+96b8ea28
Oracle Linux 8mod_ldap2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2
Oracle Linux 8mod_md1:2.0.8-8.module+el8.9.0+90011+2f9c6a23
Oracle Linux 8mod_proxy_html1:2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2
Oracle Linux 8mod_session2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2
Oracle Linux 8mod_ssl1:2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2
Oracle Linux 9httpd2.4.57-11.0.1.el9_4.1
Oracle Linux 9httpd-core2.4.57-11.0.1.el9_4.1
Oracle Linux 9httpd-devel2.4.57-11.0.1.el9_4.1
Oracle Linux 9httpd-filesystem2.4.57-11.0.1.el9_4.1
Oracle Linux 9httpd-manual2.4.57-11.0.1.el9_4.1
Oracle Linux 9httpd-tools2.4.57-11.0.1.el9_4.1
Oracle Linux 9mod_ldap2.4.57-11.0.1.el9_4.1
Oracle Linux 9mod_lua2.4.57-11.0.1.el9_4.1
Oracle Linux 9mod_proxy_html1:2.4.57-11.0.1.el9_4.1
Oracle Linux 9mod_session2.4.57-11.0.1.el9_4.1
Oracle Linux 9mod_ssl1:2.4.57-11.0.1.el9_4.1
rapidfort amazon linux 2023httpd1:2.4.61-1.amzn2023
rapidfort amazon linux 2023httpd-core2.4.61-1.amzn2023
rapidfort amazon linux 2023httpd-devel2.4.61-1.amzn2023
rapidfort amazon linux 2023httpd-filesystem2.4.61-1.amzn2023
rapidfort amazon linux 2023httpd-manual2.4.61-1.amzn2023
rapidfort amazon linux 2023httpd-tools2.4.61-1.amzn2023
rapidfort amazon linux 2023mod_ldap2.4.61-1.amzn2023
rapidfort amazon linux 2023mod_lua2.4.61-1.amzn2023
rapidfort amazon linux 2023mod_proxy_html1:2.4.61-1.amzn2023
rapidfort amazon linux 2023mod_session2.4.61-1.amzn2023
rapidfort amazon linux 2023mod_ssl1:2.4.61-1.amzn2023
rapidfort Oracle Linux 9httpd0:2.4.57-11.0.1.el9_4.1
rapidfort Oracle Linux 9httpd-core0:2.4.57-11.0.1.el9_4.1
rapidfort Oracle Linux 9httpd-devel0:2.4.57-11.0.1.el9_4.1
rapidfort Oracle Linux 9httpd-filesystem0:2.4.57-11.0.1.el9_4.1
rapidfort Oracle Linux 9httpd-manual0:2.4.57-11.0.1.el9_4.1
rapidfort Oracle Linux 9httpd-tools0:2.4.57-11.0.1.el9_4.1
rapidfort Oracle Linux 9mod_ldap0:2.4.57-11.0.1.el9_4.1
rapidfort Oracle Linux 9mod_lua0:2.4.57-11.0.1.el9_4.1
rapidfort Oracle Linux 9mod_proxy_html1:2.4.57-11.0.1.el9_4.1
rapidfort Oracle Linux 9mod_session0:2.4.57-11.0.1.el9_4.1
rapidfort Oracle Linux 9mod_ssl1:2.4.57-11.0.1.el9_4.1
rapidfort ubuntu 20.04apache20:2.4.52-1ubuntu4.10, 0:2.4.58-1ubuntu8.2
rapidfort ubuntu 20.04rf-apache20:2.4.52-1ubuntu4.10, 0:2.4.58-1ubuntu8.2
rapidfort ubuntu 22.04apache20:2.4.52-1ubuntu4.10, 0:2.4.58-1ubuntu8.2
rapidfort ubuntu 22.04rf-apache20:2.4.52-1ubuntu4.10, 0:2.4.58-1ubuntu8.2
rapidfort ubuntu 24.04apache20:2.4.52-1ubuntu4.10, 0:2.4.58-1ubuntu8.2
rapidfort ubuntu 24.04rf-apache20:2.4.52-1ubuntu4.10, 0:2.4.58-1ubuntu8.2
rocky 8httpd:2.4::httpd2.4.37-65.module+el8.10.0+1830+22f0c9e0
rocky 8httpd:2.4::httpd-devel2.4.37-65.module+el8.10.0+1830+22f0c9e0
rocky 8httpd:2.4::httpd-filesystem2.4.37-65.module+el8.10.0+1830+22f0c9e0
rocky 8httpd:2.4::httpd-manual2.4.37-65.module+el8.10.0+1830+22f0c9e0
rocky 8httpd:2.4::httpd-tools2.4.37-65.module+el8.10.0+1830+22f0c9e0
rocky 8httpd:2.4::mod_http21.15.7-10.module+el8.10.0+1775+6b057638
rocky 8httpd:2.4::mod_ldap2.4.37-65.module+el8.10.0+1830+22f0c9e0
rocky 8httpd:2.4::mod_md1:2.0.8-8.module+el8.9.0+1370+89cc8ad5
rocky 8httpd:2.4::mod_proxy_html1:2.4.37-65.module+el8.10.0+1830+22f0c9e0
rocky 8httpd:2.4::mod_session2.4.37-65.module+el8.10.0+1830+22f0c9e0
rocky 8httpd:2.4::mod_ssl1:2.4.37-65.module+el8.10.0+1830+22f0c9e0
rocky 9httpd2.4.57-11.el9_4.1
rocky 9httpd-core2.4.57-11.el9_4.1
rocky 9httpd-devel2.4.57-11.el9_4.1
rocky 9httpd-filesystem2.4.57-11.el9_4.1
rocky 9httpd-manual2.4.57-11.el9_4.1
rocky 9httpd-tools2.4.57-11.el9_4.1
rocky 9mod_ldap2.4.57-11.el9_4.1
rocky 9mod_lua2.4.57-11.el9_4.1
rocky 9mod_proxy_html1:2.4.57-11.el9_4.1
rocky 9mod_session2.4.57-11.el9_4.1
rocky 9mod_ssl1:2.4.57-11.el9_4.1
root.io debian 12rootio-apache22.4.61-1~deb12u1
root.io debian 13rootio-apache22.4.60-1
ubuntu 16.04-ESMapache22.4.18-2ubuntu3.17+esm13
ubuntu 18.04-ESMapache22.4.29-1ubuntu4.27+esm3
ubuntu 20.04apache22.4.41-4ubuntu3.19
ubuntu 20.04-ESMapache22.4.41-4ubuntu3.19
ubuntu 22.04apache22.4.52-1ubuntu4.10
ubuntu 23.10apache22.4.57-2ubuntu2.5
ubuntu 24.04apache22.4.58-1ubuntu8.2
ubuntu 24.10apache22.4.62-1ubuntu1
ubuntu 25.04apache22.4.62-1ubuntu1
ubuntu 25.10apache22.4.62-1ubuntu1
ubuntu 26.04apache22.4.62-1ubuntu1

References

All 21 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.