mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV…
Priority MEDIUM 43Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Partial
- Fix status
- Partial Red Hat: 13 fixed, 3 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.
Summary
mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.
Why it matters now
EPSS 0.29484 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 6 advisoriesRed Hat: 13 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 22
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | 2.2.0 to before 2.2.25; 2.4.1 to before 2.4.6 | Vulnerable | Apache |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* | 6.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:* | 6.4.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* | 5.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 6.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:* | 5.9 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:* | 6.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
- cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* Versions 2.2.0 to before 2.2.25; 2.4.1 to before 2.4.6 Vulnerable ·Apache
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:* Versions 5.9 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
Show 12 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:* | 5.9 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:* | 6.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:* | 10.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* | 12.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* | 12.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:* | 13.04 | Vulnerable | Canonical |
| cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:* | 11.4 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:* | 12.2 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:* | 12.3 | Vulnerable | openSUSE |
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:* Versions 5.9 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:* Versions 10.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* Versions 12.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* Versions 12.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:* Versions 13.04 Vulnerable ·Canonical
- cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:* Versions 11.4 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:* Versions 12.2 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:* Versions 12.3 Vulnerable ·openSUSE
Remediation
Red Hat 6 advisories
- RHSA-2013:1209 Released 2013-09-04 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 6.1.1 update
- Red Hat JBoss Enterprise Application Platform 6.1
- RHSA-2013:1208 Released 2013-09-04 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 6.1.1 update
- Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server apache-commons-beanutils-1.8.3-12.redhat_3.2.ep6.el6, apache-commons-daemon-jsvc-eap6-1:1.0.15-2.redhat_2.ep6.el6, apache-commons-daemon-jsvc-eap6-1:1.0.15-2.redhat_2.ep6.el6.i386 +47
- RHSA-2013:1207 Released 2013-09-04 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 6.1.1 update
- Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server apache-commons-beanutils-1.8.3-12.redhat_3.2.ep6.el5, apache-commons-daemon-jsvc-eap6-1:1.0.15-2.redhat_2.ep6.el5, apache-commons-daemon-jsvc-eap6-1:1.0.15-2.redhat_2.ep6.el5.i386 +47
Show 3 more Red Hat advisories
- RHSA-2013:1156 Released 2013-08-13 · Red Hat rating Moderatehttpd security update
- Red Hat Enterprise Linux (v. 5 server) httpd-2.2.3-82.el5_9, httpd-2.2.3-82.el5_9.i386, httpd-2.2.3-82.el5_9.ia64 +13
- Red Hat Enterprise Linux Desktop (v. 6) httpd-2.2.15-29.el6_4, httpd-tools-2.2.15-29.el6_4
- Red Hat Enterprise Linux Desktop Optional (v. 6) httpd-2.2.15-29.el6_4, httpd-devel-2.2.15-29.el6_4, httpd-manual-2.2.15-29.el6_4 +1
- Red Hat Enterprise Linux HPC Node (v. 6) httpd-2.2.15-29.el6_4, httpd-tools-2.2.15-29.el6_4
- Red Hat Enterprise Linux HPC Node Optional (v. 6) httpd-2.2.15-29.el6_4, httpd-devel-2.2.15-29.el6_4, httpd-manual-2.2.15-29.el6_4 +1
- Red Hat Enterprise Linux Server (v. 6) httpd-2.2.15-29.el6_4, httpd-devel-2.2.15-29.el6_4, httpd-devel-2.2.15-29.el6_4.ppc +3
- Red Hat Enterprise Linux Workstation (v. 6) httpd-2.2.15-29.el6_4, httpd-devel-2.2.15-29.el6_4, httpd-manual-2.2.15-29.el6_4 +2
- RHSA-2013:1134 Released 2013-08-05 · Red Hat rating Moderatehttpd security update
- Red Hat JBoss Web Server 2.0
- RHSA-2013:1133 Released 2013-08-05 · Red Hat rating Moderatehttpd security update
- Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server httpd-2.2.22-25.ep6.el5, httpd-2.2.22-25.ep6.el5.i386, httpd-devel-2.2.22-25.ep6.el5 +7
- Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server httpd-2.2.22-25.ep6.el6, httpd-2.2.22-25.ep6.el6.i386, httpd-devel-2.2.22-25.ep6.el6 +7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Directory Server 8 | Affected | — |
| Red Hat Enterprise Linux 4 | Affected | No fix yet |
| Red Hat JBoss Enterprise Web Server 1 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2013:1156 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2013:1156 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2013:1156 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2013:1156 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2013:1156 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2013:1156 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2013:1156 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server | Fixed | RHSA-2013:1207 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server | Fixed | RHSA-2013:1208 |
| Red Hat JBoss Enterprise Application Platform 6.1 | Fixed | RHSA-2013:1209 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server | Fixed | RHSA-2013:1133 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server | Fixed | RHSA-2013:1133 |
| Red Hat JBoss Web Server 2.0 | Fixed | RHSA-2013:1134 |
Not affected: 1 product
- Red Hat Enterprise Linux 7
Timeline
- 2026-10-02 Threatist record created from CVE-2013-1896
- 2026-10-03 Alias added: GHSA-g852-xcg2-2w9v
References
Advisory 17
- http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?view=log
- http://www-01.ibm.com/support/docview.wss?uid=swg21644047
- SSRT101288
- RHSA-2013:1209
- oval:org.mitre.oval:def:18835
- openSUSE-SU-2013:1340
- oval:org.mitre.oval:def:19747
- http://support.apple.com/kb/HT6150
- RHSA-2013:1156
- USN-1903-1
- RHSA-2013:1207
- http://www.apache.org/dist/httpd/Announcement2.2.html
- RHSA-2013:1208
- 20130822 Apache HTTP Server MERGE Request Denial of Service Vulnerability
- https://httpd.apache.org/security/vulnerabilities_24.html
- openSUSE-SU-2013:1341
- openSUSE-SU-2013:1337
Other 19
- [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073139 [8/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
- [httpd-cvs] 20210330 svn commit: r1888194 [8/13] - /httpd/site/trunk/content/security/json/
- [httpd-cvs] 20210330 svn commit: r1073149 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/
- [httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
Sources
- CVE-2013-1896 · CVE Program
- CVE-2013-1896 · NVD
- FIRST EPSS
- GHSA-g852-xcg2-2w9v · GitHub Advisory Database · CC BY 4.0
- CVE-2013-1896 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences