CVE-2024-38476: exploitation status and patch state

CVE-2024-38476 · CVSS 9.8 CRITICAL · EPSS 42%

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Is CVE-2024-38476 exploited?

• Not in the CISA KEV catalog.
• EPSS puts exploitation in the next 30 days at 42%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2024-38476

PlainSec has not published a story about this CVE.

Primary sources

• NVD record

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-11.