vulnerability

Alpine Linux: CVE-2024-38476: Inclusion of Functionality from Untrusted Control Sphere

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:C/I:C/A:C)

Published

Jul 1, 2024

Added

Aug 22, 2024

Modified

Jun 18, 2026

Description

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.

Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Solution

alpine-linux-upgrade-apache2

References

CVE-2024-38476
https://attackerkb.com/topics/CVE-2024-38476
https://security.alpinelinux.org/vuln/CVE-2024-38476
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-37357
CWE-829
EUVD-EUVD-2024-37357

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report