TI-2024-31312 Aliases CVE-2024-46901 GHSA-53gr-8h72-9w7p

Apache Subversion: mod_dav_svn denial-of-service via control characters in paths

LOW 24CWE-116Published 2024-12-09 · Updated 2025-04-13

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · Low
Fix status: Deferred Red Hat: fix deferred

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository. All versions of Subversion up to and including Subversion 1.14.4 are affected if serving repositories via mod_dav_svn. Users are recommended to upgrade to version 1.14.5, which fixes this issue. Repositories served via other access methods are not affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0193 80th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Subversion	up to 1.14.4	—	No fix listed	CNA

Apache Subversion VendorApache Affected up to 1.14.4 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:subversion::::::::	before 1.14.5	Vulnerable	Apache
cpe:2.3:o:debian:debian_linux:11.0:::::::*	11.0	Vulnerable	Debian

cpe:2.3:a:apache:subversion:*:*:*:*:*:*:*:* Versions before 1.14.5 Vulnerable ·Apache
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2024-46901
2026-10-03 Alias added: GHSA-53gr-8h72-9w7p

References

Exploit 1

https://subversion.apache.org/security/CVE-2024-46901-advisory.txt

Advisory 1

https://lists.debian.org/debian-lts-announce/2025/04/msg00023.html

TI-2015-04418 Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache… CVSS 3.0HIGH 8.6
TI-2018-08457 Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.3 will… CVSS 3.1HIGH 7.5
TI-2020-13273 Remote unauthenticated denial-of-service in Subversion mod_authz_svn CVSS 3.1HIGH 7.5
TI-2017-07180 Improper input validation in Apache Subversion CVSS 3.0CRITICAL 9.8
TI-2015-04497 Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before… CVSS 3.0HIGH 7.6
TI-2013-01858 contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote… CVSS 2.0HIGH 7.1

See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences