CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
Last updated 20 August 2025
Other sources
SSRF in Apache HTTP Server with modproxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely configuration where modheaders is configured to modify the Content-Type request or response header with a value provided in the HTTP request.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43204?
CVE-2024-43204 has a high severity rating due to its potential for SSRF attacks, allowing attackers to send malicious outbound requests.
How do I fix CVE-2024-43204?
To fix CVE-2024-43204, ensure that mod_headers is not configured to modify the Content-Type header in a way that allows attacker-controlled values.
What versions of Apache HTTP Server are affected by CVE-2024-43204?
Apache HTTP Server versions up to, but not including, 2.4.64 are affected by CVE-2024-43204.
What is SSRF as it relates to CVE-2024-43204?
SSRF, or Server-Side Request Forgery, in CVE-2024-43204 allows attackers to make outbound requests to URLs they control.
Are there any workarounds for CVE-2024-43204?
While proper configuration is key, a possible workaround is to disable mod_proxy in any vulnerable configurations to mitigate the risk of CVE-2024-43204.