CVE-2024-38477

highpriority · track · 31EPSS 0.032 · 88 %ileDEEUJPNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

3.15% (88th) EPSS

CVSS 7.5 · high

Is it mine?

116 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-24

null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondaryexploitability 3.9 · impact 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-404USCWE-404USCWE-476USCWE-476US

affected products (116)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Dell PowerProtect Data Domainall versionscert_bundDEcpe:/a:dell:powerprotect_data_domain:-
Dell PowerScale OneFSall versionscert_bundDEcpe:/a:dell:powerscale_onefs:onefs
F5 BIG-IPall versionscert_bundDEcpe:/a:f5:big-ip:-
F5 BIG-IP 15.1.0-15.1.10all versionscert_bundDEcpe:/a:f5:big-ip:15.1.0_-_15.1.10
F5 BIG-IP 16.1.0-16.1.5all versionscert_bundDEcpe:/a:f5:big-ip:16.1.0_-_16.1.5
F5 BIG-IP 17.1.0-17.1.1all versionscert_bundDEcpe:/a:f5:big-ip:17.1.0_-_17.1.1
Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
Gentoo Linuxall versionscert_bundDEcpe:/o:gentoo:linux:-
HCL Commerce 8.xall versionscert_bundDEcpe:/a:hcltechsw:commerce:8.x
HCL Commerce 9.0-9.0.1.21all versionscert_bundDEcpe:/a:hcltechsw:commerce:9.0_-_9.0.1.21
HCL Commerce 9.1.0-9.1.15all versionscert_bundDEcpe:/a:hcltechsw:commerce:9.1.0_-_9.1.15
Hitachi Command Suiteall versionscert_bundDEcpe:/a:hitachi:command_suite:-
Hitachi Configuration Managerall versionscert_bundDEcpe:/a:hitachi:configuration_manager:-
Hitachi Ops Centerall versionscert_bundDEcpe:/a:hitachi:ops_center:-
IBM Business Automation Workflowall versionscert_bundDEcpe:/a:ibm:business_automation_workflow:-
IBM Business Automation Workflow 24.0.0all versionscert_bundDEcpe:/a:ibm:business_automation_workflow:24.0.0
IBM HTTP Server 8.5all versionscert_bundDEcpe:/a:ibm:http_server:8.5
IBM HTTP Server 9.0all versionscert_bundDEcpe:/a:ibm:http_server:9.0

showing 20 of 116

advisories (9)

Vendor and ecosystem advisories describing this.

NCSC-2024-0275Kwetsbaarheden verholpen in Apache HHTP-serverNL2024-07-02csaf · ncsc_nlNL
Apache Software Foundation heeft kwetsbaarheden verholpen in de Apache HTTP-Server.
NCSC-2024-0411Kwetsbaarheden verholpen in Oracle Database productenNL2024-10-17csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in diverse Database producten en subsystemen, zoals de Core database, Application Express, Autonomous Health Framework, Essbase, GoldenGate, SQL Developer en Secure Backup.
NCSC-2024-0426Kwetsbaarheden verholpen in Apple MacOSNL2024-10-30csaf · ncsc_nlNL
Apple heeft kwetsbaarheden verholpen in MacOS.
WID-SEC-W-2024-1504Apache HTTP Server: Mehrere SchwachstellenDeutsch2024-07-01csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.
WID-SEC-W-2024-3291Apple macOS: Mehrere SchwachstellenDeutsch2024-10-28csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apple macOS ausnutzen, um einen Denial of Service Angriff durchzuführen.
WID-SEC-W-2025-1572Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2025-07-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
BIT-apache-2024-38477Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request2024-07-03vendor · osvUS
null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
JVNDB-2026-003907JVN iPedia advisory JVNDB-2026-0039072026-02-17vendor · jvndbJP
JVNDB-2026-003909JVN iPedia advisory JVNDB-2026-0039092026-02-17vendor · jvndbJP

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund ncsc_nl osv jvndb NVD CVE.org MITRE

published 2024-07-01modified 2026-06-17

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan