# CVE-2024-38476: Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect

- Exploited (CISA KEV): no
- Published: 2024-07-01
- CVSS: 9.8 CRITICAL (v3.1)
- EPSS: 41.6% (99th percentile)
- CWE: CWE-829

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.

Users are recommended to upgrade to version 2.4.60, which fixes this issue.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2024-09-17 | 78 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### F5

- 2024-09-17 · new · rule 200007072
  > Added: signature 200007072 "Apache mod_rewrite Filename Confusion" (Path Traversal, risk Low), systems: Apache. References: CVE-2024-39573, CVE-2024-38475, CVE-2024-38474, CVE-2024-38476.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog
- 2025-04-28 · updated · rule 200007072
  > Updated: signature 200007072 "Apache mod_rewrite Filename Confusion" (Path Traversal, risk Low), systems: Apache. References: CVE-2024-39573, CVE-2024-38475, CVE-2024-38474, CVE-2024-38476, CVE-2024-38473.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog
- 2025-05-22 · updated · rule 200007072
  > Updated: signature 200007072 "Apache mod_rewrite Filename Confusion" (Path Traversal, risk Low), systems: Apache. References: CVE-2024-39573, CVE-2024-38475, CVE-2024-38474, CVE-2024-38476, CVE-2024-38473.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2024-38476 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2024-38476