CVE-2024-43204·Apache vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.23% — higher than 45% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2024-43204 scores 7.5 on CVSS, so a successful attack would be serious — but at 0.23%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

How to fix this CVE

Upgrade Apache HTTP Server to version 2.4.64 or later to address this Server-Side Request Forgery (SSRF) vulnerability. Organizations running Apache with mod_proxy enabled should prioritize this update, particularly if mod_headers is configured to process user-controlled Content-Type headers. This vulnerability allows attackers to manipulate proxy requests to reach internal or external targets when specific header configurations are present.

sudo dnf update httpd

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

GET|POST|HEAD request with crafted Content-Type header containing external URLs (e.g., http:// or https://) followed by proxy response status codes (200, 301, 302) to non-standard ports; regex: (Content-Type:.*http[s]?://[^\s]+|X-Forwarded-.*http[s]?://[^\s]+)

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Configure WAF rules to block HTTP requests with suspicious Content-Type or X-Forwarded-* headers containing URL schemes (http://, https://, ftp://). Implement strict header validation to reject requests where these headers contain values other than standard MIME types. Restrict access to proxy endpoints to trusted internal networks only.

How to check if you are affected

1. Step 1: Check Apache version by running: apache2ctl -v (Ubuntu/Debian) or httpd -v (RHEL/CentOS). Compare against 2.4.64 — versions below this are vulnerable.
2. Step 2: Verify if mod_proxy is loaded: grep -i 'mod_proxy' /etc/apache2/mods-enabled/*.conf (Ubuntu/Debian) or /etc/httpd/modules/ (RHEL/CentOS). If present and mod_headers is also enabled, your configuration is at risk.
3. Step 3: Search Apache access and error logs for unusual outbound proxy requests: grep -i 'proxy' /var/log/apache2/access.log | grep -E '(http://|https://)' to identify potential exploitation attempts.
4. Step 4: After upgrading, confirm the version: apache2ctl -v or httpd -v should display 2.4.64 or higher, and restart Apache with: sudo systemctl restart apache2 (Ubuntu/Debian) or sudo systemctl restart httpd (RHEL/CentOS).

FAQ

Related Apache CVEs

References

• https://httpd.apache.org/security/vulnerabilities_24.html
• http://www.openwall.com/lists/oss-security/2025/07/10/2
• http://www.openwall.com/lists/oss-security/2025/07/10/4
• https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html