Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H N 9.1 .9996 100.0 YES
AFFECTED Product Versions Fixed Apache HTTP Server 2.4.0 – —
TIMELINE Jun 17 Reserved by apache Jul 1 Published (CNA: apache) May 1 Added to CISA KEV, remediation due 2025-05-22
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
| Date | Event | Detail |
|---|---|---|
| June 17, 2024 | Reserved | Reserved by apache |
| July 1, 2024 | Published | Published (CNA: apache) |
| May 1, 2025 | KEV ADDED | Added to CISA KEV, remediation due 2025-05-22 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server | — | 2.4.0 | — |
Authoritative record: CVE-2024-38475 at cve.org
Vendors: apache
Weaknesses: CWE-116
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-38475 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
