Description
mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache2 | 2.4.6-1 | — |
| Debian 13 | apache2 | 2.4.6-1 | — |
| Debian 12 | apache2 | 2.4.6-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | httpd +3 | 2.2.15-29.el6_4 | RHSA-2013:1156 |
| RHEL 6 | mod_ssl | 1:2.2.15-29.el6_4 | RHSA-2013:1156 |
| RHEL 5 | httpd +2 | 2.2.3-82.el5_9 | RHSA-2013:1156 |
| RHEL 5 | mod_ssl | 1:2.2.3-82.el5_9 | RHSA-2013:1156 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 2 | httpd +3 | 2.2.22-25.ep6.el5 | RHSA-2013:1133 |
| Red Hat JBoss Web Server 2 | mod_ssl | 1:2.2.22-25.ep6.el5 | RHSA-2013:1133 |
| Red Hat JBoss EAP 6 | apache-commons-beanutils | 1.8.3-12.redhat_3.2.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | apache-commons-daemon-jsvc-eap6 | 1:1.0.15-2.redhat_2.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | apache-cxf | 2.6.8-8.redhat_7.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | cxf-xjc-dv +3 | 2.6.0-2.redhat_4.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | hibernate4 +4 | 4.2.0-7.SP1_redhat_1.ep6.el6 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.5-2.Final_redhat_2.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | hornetq-native +1 | 2.3.5-1.Final_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | httpd +3 | 2.2.22-25.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | infinispan +4 | 5.2.7-1.Final_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | ironjacamar +9 | 1.0.19-1.Final_redhat_2.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jaxbintros | 1.0.2-16.GA_redhat_6.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-aesh | 0.33.7-2.redhat_2.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-as-console | 1.5.6-2.Final_redhat_2.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-as-ee +56 | 7.2.1-5.Final_redhat_10.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-ejb-client | 1.0.23-1.Final_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-hal | 1.5.7-1.Final_redhat_1.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-invocation | 1.1.2-1.Final_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-jsp-api_2.2_spec | 1.0.1-6.Final_redhat_2.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-logmanager | 1.4.3-1.Final_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-marshalling | 1.3.18-1.GA_redhat_1.1.ep6.el6 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-modules | 1.2.2-1.Final_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-remote-naming | 1.0.7-1.Final_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-security-negotiation | 2.2.5-2.Final_redhat_2.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-stdio | 1.0.2-1.GA_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jbossas-core +1 | 7.2.1-6.Final_redhat_10.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.2.1-2.Final_redhat_10.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jbossas-modules-eap | 7.2.1-9.Final_redhat_10.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jbossts | 1:4.17.7-4.Final_redhat_4.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jbossweb | 7.2.2-1.Final_redhat_1.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jbossws-cxf | 4.1.4-7.Final_redhat_7.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jbossws-spi +1 | 2.1.3-1.Final_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jcip-annotations-eap6 | 1.0-4.redhat_4.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jgroups | 1:3.2.10-1.Final_redhat_2.2.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | log4j-jboss-logmanager | 1.0.2-1.Final_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | mod_ssl | 1:2.2.22-25.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | netty | 3.6.6-2.Final_redhat_1.1.ep6.el6 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | opensaml | 2.5.1-2.redhat_2.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | openws | 1.4.2-10.redhat_4.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | picketbox | 4.0.17-3.SP2_redhat_2.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | picketlink-federation | 2.1.6.3-2.Final_redhat_2.2.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | wss4j | 1.6.10-1.redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | xml-security | 1.5.5-1.redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2 | 2.4.23-4.1 | openSUSE-SU-2024:10268-1 |
Advisories 5
- RHSA-2013:1207 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.1.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:1208 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.1.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:1156 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2013:1133 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · May 15, 2026
- openSUSE-SU-2024:10268-1 apache2-2.4.23-4.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?view=log
- http://www-01.ibm.com/support/docview.wss?uid=swg21644047
- SSRT101288 vendor-advisory
- RHSA-2013:1209 vendor-advisory
- oval:org.mitre.oval:def:18835 vdb-entry signature
- http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?r1=1482522&r2=1485668&diff_format=h
- openSUSE-SU-2013:1340 vendor-advisory
- oval:org.mitre.oval:def:19747 vdb-entry signature
- http://support.apple.com/kb/HT6150
- RHSA-2013:1156 vendor-advisory
- USN-1903-1 vendor-advisory
- RHSA-2013:1207 vendor-advisory
- 61129 vdb-entry
- http://www.apache.org/dist/httpd/Announcement2.2.html
- RHSA-2013:1208 vendor-advisory
- 20130822 Apache HTTP Server MERGE Request Denial of Service Vulnerability vendor-advisory
- https://httpd.apache.org/security/vulnerabilities_24.html
- openSUSE-SU-2013:1341 vendor-advisory
- 55032 third-party-advisory
- openSUSE-SU-2013:1337 vendor-advisory
- [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [8/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [8/13] - /httpd/site/trunk/content/security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list
- [httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list