Security Resilience

CWE · MITRE source

CWE-918Server-Side Request Forgery (SSRF)

Abstraction: Base · CVEs in our corpus: 3,902

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Last updated: 16 October 2026 10:19 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A01:2025 Broken Access Control.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SI-10 Information Input Validation
  • SI-4 System Monitoring
  • CA-8 Penetration Testing
  • SC-7 Boundary Protection
Detect
Catch it (CSF Detect / Respond)
  • DE.CM-09
Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.3.6
  • V1.5.3
  • V5.3.2
  • V10.4.7

NIST 800-53 r5 controls PROPOSED for this weakness (4)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control Title Family Why it addresses this CWE
SI-10Information Input ValidationSIgraded mostly Validates server-side URLs and resource references to block SSRF attempts.
SI-4System MonitoringSIDetects server-side request forgery through monitoring of unexpected outbound connections.
CA-8Penetration TestingCAPenetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.
SC-7Boundary ProtectionSCOutbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2026-49869 KEV 10.010.00.02092026-06-26
CVE-2026-15409 KEV10.010.00.06792026-07-14
CVE-2026-83548 KEV10.010.00.08042026-09-01
CVE-2018-14728 9.99.80.76262018-08-03
CVE-2020-7796 KEV 9.99.80.84422020-02-18
CVE-2020-26948 9.99.80.87152020-10-10
CVE-2021-27103 KEV 9.99.80.11412021-02-16
CVE-2021-22986 KEV 9.99.80.99902021-03-31
CVE-2021-27905 9.99.80.93052021-04-13
CVE-2021-21985 KEV 9.99.81.00002021-05-26
CVE-2023-48022 9.99.80.83942023-11-28
CVE-2023-51467 9.99.80.96002023-12-26
CVE-2024-45507 9.99.80.93232024-09-04
CVE-2020-24881 9.89.80.73452020-11-02
CVE-2021-32682 9.89.80.69932021-06-14
CVE-2022-1386 9.89.80.71432022-05-16
CVE-2021-27670 9.69.80.61272021-02-25
CVE-2021-26855 KEV 9.59.11.00002021-03-03
CVE-2021-34473 KEV 9.59.11.00002021-07-14
CVE-2021-24472 9.59.80.56612021-08-02
CVE-2021-33690 9.49.90.69072021-09-15
CVE-2023-49785 9.49.10.83162024-03-12
CVE-2026-64849 KEV 9.39.30.09842026-08-17
CVE-2020-35313 9.29.80.45222021-04-20
CVE-2022-41040 KEV 9.28.80.99962022-10-03