VulnIntel

CVE-2024-38809

CVSS 5.3 · MEDIUM
EPSS p54
Higher than 54% of all CVEs — moderate exploitation risk.
No patch reference
No patch/mitigation in references

Published 9/27/2024 · updated 6/17/2026 · CWE-400

Share
Get asset-aware triage

Summary

Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions should upgrade to the corresponding fixed version. Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter.

CVSS 5.3 — MEDIUM

5.3 / 10
  • AV: Network
  • AC: Low complexity
  • PR: No privileges
  • UI: No user interaction
  • S: Scope unchanged
  • C: Confidentiality: None
  • I: Integrity: None
  • A: Availability: Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS exploitation probability

0.9%

Percentile p54 — Higher than 54% of all CVEs — moderate exploitation risk.

Timeline

  1. Sep 27, 2024 · Disclosed / published in NVD
  2. Jun 17, 2026 · Intel last updated

Intel sources

Which upstream feeds returned data for this CVE, and when they were last fetched.

  • NVD· 46 days ago
  • CVE.org· no data
  • FIRST EPSS· 46 days ago
  • CISA KEV· no data
  • OSV· no data

References

Other2

Unlock the full report

See how CVE-2024-38809 hits your stack.

Free public data ends here. Sign in to correlate this CVE against your SBOM and assets, get an AI-grounded exploit chain, generate a ModSecurity virtual patch, and share findings with your team.

  • · Asset-aware CVSS & priority
  • · Grounded AI analysis (A–D graded)
  • · Auto-generated WAF / IPS rules
  • · Jira, SIEM, Slack, Teams delivery

No credit card · 100 free enrichments · analyst-grade citations.