CVE-2024-43204
Apache HTTP Server: SSRF with mod_headers setting Content-Type header
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Apache HTTP Server: SSRF with mod_headers setting Content-Type header
SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request. Users are recommended to upgrade to version 2.4.64 which fixes this issue.
Reserved 2024-08-08 | Published 2025-07-10 | Updated 2025-07-10 | Assigner apacheCWE-918 Server-Side Request Forgery (SSRF)
| 2024-08-07: | reported |
httpd.apache.org/security/vulnerabilities_24.html
Support options
