Apache HTTP Server: Proxy Rewrite to Unix Socket Failure with CVE-2021-40438 Fix

mod_http2 Updated 02 Oct 2025

Summary

10/11/2021

Disclosed on

N/A

Severity

Yes i

Fix available

Unrated

Severity

Not published

CVSS Score

ALBA-2021:4604: httpd:2.4 bug fix update. Affects mod_http2 versions < 1.15.7-3.module_el8.5.0+2609+b30d9eec. Fixed in 1.15.7-3.module_el8.5.0+2609+b30d9eec. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The Apache HTTP Server is a widely used web server known for its power, efficiency, and extensibility. It provides a platform for hosting websites and serving web content. The mod_http2 and mod_md packages are modules for the Apache HTTP Server that enhance its functionality.

mod_http2 is a module that adds support for the HTTP/2 protocol, allowing for faster and more efficient communication between clients and servers. mod_md, on the other hand, is a module that provides support for managing SSL/TLS certificates.

These packages are used in AlmaLinux 8, an open-source Linux distribution based on the Red Hat Enterprise Linux (RHEL) source code.

Vulnerability Detail

The vulnerability identified as CVE-2021-40438 affects the Apache HTTP Server when using the mod_http2 and mod_md packages. It is related to a bug fix update in the httpd packages.

The specific issue is that proxy rewrite to a Unix socket fails when the CVE-2021-40438 fix is applied. This fix was implemented to address a separate vulnerability, but it unintentionally introduced a regression that affects the proxy rewrite functionality.

The impact of this vulnerability is that proxy rewrite rules that target Unix sockets will no longer work as expected, potentially leading to incorrect routing or failure to establish connections.

How To Fix

Minimum fixed version

1.15.7-3.module_el8.5.0+2609+b30d9eec

This is the first release that contains the fix.

sudo dnf update mod_http2

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the affected packages to the fixed versions.

Conclusion

The Apache HTTP Server is vulnerable to a regression introduced by the CVE-2021-40438 fix, which affects the proxy rewrite functionality to Unix sockets. To mitigate this vulnerability, it is crucial to update the mod_http2 and mod_md packages to the specified fixed versions. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for mod_http2 →