CWE-918Server-Side Request Forgery (SSRF)

Abstraction: Base · CVEs in our corpus: 3,264

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Last updated: 22 August 2026 20:22 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 1 mapping(s) from 1 framework(s): CAPEC 1 (mostly)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A01:2025 Broken Access Control.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

SI-10 Information Input Validation
SI-4 System Monitoring
CA-8 Penetration Testing
SC-7 Boundary Protection

Detect

Catch it (CSF Detect / Respond)

DE.CM-09

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V1.3.6
V1.5.3
V5.3.2
V10.4.7

NIST 800-53 r5 controls that address this weakness (4)AI-assisted

Control	Title	Family	Why it addresses this CWE
`SI-10`	Information Input Validation	SI	Validates server-side URLs and resource references to block SSRF attempts.
`SI-4`	System Monitoring	SI	Detects server-side request forgery through monitoring of unexpected outbound connections.
`CA-8`	Penetration Testing	CA	Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.
`SC-7`	Boundary Protection	SC	Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2026-15409` KEV	10.0	10.0	0.7422	2026-07-14
`CVE-2018-14728`	9.9	9.8	0.7651	2018-08-03
`CVE-2020-7796` KEV	9.9	9.8	0.8442	2020-02-18
`CVE-2020-26948`	9.9	9.8	0.8715	2020-10-10
`CVE-2021-27103` KEV	9.9	9.8	0.1132	2021-02-16
`CVE-2021-22986` KEV	9.9	9.8	0.9990	2021-03-31
`CVE-2021-27905`	9.9	9.8	0.9305	2021-04-13
`CVE-2021-21985` KEV	9.9	9.8	1.0000	2021-05-26
`CVE-2023-48022`	9.9	9.8	0.8394	2023-11-28
`CVE-2023-51467`	9.9	9.8	0.9600	2023-12-26
`CVE-2024-45507`	9.9	9.8	0.9323	2024-09-04
`CVE-2020-24881`	9.8	9.8	0.7327	2020-11-02
`CVE-2021-32682`	9.8	9.8	0.6993	2021-06-14
`CVE-2022-1386`	9.8	9.8	0.7208	2022-05-16
`CVE-2021-27670`	9.6	9.8	0.6127	2021-02-25
`CVE-2021-26855` KEV	9.5	9.1	1.0000	2021-03-03
`CVE-2021-34473` KEV	9.5	9.1	1.0000	2021-07-14
`CVE-2021-24472`	9.5	9.8	0.5661	2021-08-02
`CVE-2021-33690`	9.4	9.9	0.6907	2021-09-15
`CVE-2023-49785`	9.4	9.1	0.8316	2024-03-12
`CVE-2026-64849` KEV	9.3	9.3	0.0815	2026-08-17
`CVE-2020-35313`	9.2	9.8	0.4522	2021-04-20
`CVE-2022-41040` KEV	9.2	8.8	0.9996	2022-10-03
`CVE-2025-30220`	9.2	9.9	0.5672	2025-06-10
`CVE-2019-16932`	9.1	10.0	0.3914	2019-09-30