CVE-2024-38476

9.8 criticalEPSS 42%

Critical (9.8). EPSS 42% chance of exploitation in the next 30 days.

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 42% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE: CWE-829
Published: 2024-07-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:http_server
netapp:clustered_data_ontap

References

https://httpd.apache.org/security/vulnerabilities_24.html
https://security.netapp.com/advisory/ntap-20240712-0001/
http://seclists.org/fulldisclosure/2024/Oct/11
http://www.openwall.com/lists/oss-security/2024/07/01/9
https://httpd.apache.org/security/vulnerabilities_24.html

Check your stack JSON