Is CVE-2024-38475 being actively exploited?

Yes. CVE-2024-38475 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on May 1, 2025.

What is the CVSS score for CVE-2024-38475?

CVE-2024-38475 has a CVSS 3.1 base score of 9.1 (CRITICAL).

CVE-2024-38475

CRITICAL · CVSS 9.1CISA KEV: actively exploitedEPSS 100.0%EU EUVD: exploited

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

Key facts

CVSS score: 9.1 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-116
EPSS score: 100.0% (100th percentile)
In CISA KEV: Yes, added May 1, 2025
In EU EUVD: Yes (EUVD-2024-37356)
Published: July 1, 2024
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Apache HTTP Server Improper Escaping of Output Vulnerability

Added to the KEV catalog on May 1, 2025; federal remediation due May 22, 2025.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2024-37356 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on November 3, 2025.

View on the EU Vulnerability Database

Affected products

apache / http server
netapp / ontap 9
sonicwall / sma 200
sonicwall / sma 200 firmware
sonicwall / sma 210
sonicwall / sma 210 firmware
sonicwall / sma 400
sonicwall / sma 400 firmware
sonicwall / sma 410
sonicwall / sma 410 firmware
sonicwall / sma 500v
sonicwall / sma 500v firmware

Certified products that may be affected

4 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

NetApp Volume Encryption (NVE) Appliances running ONTAP 9.14.1 - NetApp, Inc. - Common Criteria CCEVS-VR-VID-11475-2024 - active
NetApp Storage Encryption (NSE) Running ONTAP 9.14.1 - NetApp, Inc. - Common Criteria CCEVS-VR-VID-11477-2024 - active
NetApp Volume Encryption (NVE) Appliances running ONTAP 9.7P13 - NetApp, Inc. - Common Criteria CCEVS-VR-VID-11175-2021 - archived
NetApp Storage Encryption (NSE) running ONTAP 9.7P13 - NetApp, Inc. - Common Criteria CCEVS-VR-VID-11174-2021 - archived

References

http://www.openwall.com/lists/oss-security/2024/07/01/8(Third Party Advisory)
https://github.com/apache/httpd/commit/9a6157d1e2f7ab15963020381054b48782bc18cf(Patch)
https://httpd.apache.org/security/vulnerabilities_24.html(Vendor Advisory)
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018(Third Party Advisory)
https://security.netapp.com/advisory/ntap-20240712-0001/(Third Party Advisory)
https://www.blackhat.com/us-24/briefings/schedule/index.html#confusion-attacks-exploiting-hidden-semantic-ambiguity-in-apache-http-server-pre-recorded-40227(Third Party Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38475(Third Party Advisory, US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain