CVE-2024-43204

Apache HTTP Server: SSRF with mod_headers setting Content-Type header

SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker.  Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request. Users are recommended to upgrade to version 2.4.64 which fixes this issue.

We have discovered 1,248,307 live websites that are affected by CVE-2024-43204.

Run a Free Instant Scan



Affected Software

Product  Apache
Category Web Servers
Vulnerable Domains1,248,307 live websites (50% of Apache install base)
Vulnerable Versions
  • from 2.4 through 2.4.63
Vulnerable Versions Count56 versions ( 46% of all versions)


Common Weakness Enumeration

CWE-918 Server-Side Request Forgery (SSRF)



Details

  • Published - Jul 10, 2025
  • Updated - Nov 4, 2025

Website Distribution by Country

Number of websites using CVE-2024-43204
United States372,241 websites


Germany148,920 websites
France77,874 websites
Netherlands52,700 websites
Japan49,796 websites
Russia44,537 websites
Italy43,342 websites
Czech Republic37,429 websites
GB31,908 websites
Singapore30,970 websites

Website Distribution by TLD

Number of websites using CVE-2024-43204
.com450,968 websites
.de85,954 websites
.org59,870 websites
.net50,232 websites
.nl39,635 websites
.ru39,297 websites
.it38,419 websites
.cz30,925 websites
.fr25,572 websites
.pl23,074 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-43204

Top websites that are affected by CVE-2024-43204. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*************.***.****.****.************.net United States***
*********.net United States***
****************.net United States*,***
***.****.us United States*,***
***.*********.com Singapore*,***
*****.*******.com Singapore*,***
******.net Sweden*,***
******************.com United States*,***
*******.**.com United States*,***
****.*********.net GB*,***
See full domain list

FAQ

CVE-2024-43204 is Server-Side Request Forgery (SSRF) in Apache
A total of 1,248,307 websites have been identified as vulnerable to CVE-2024-43204, based on global website indexing conducted by WebTechSurvey.
The Apache is affected by the CVE-2024-43204 vulnerability.
Apache versions up to and including 2.4.63 are vulnerable to CVE-2024-43204.