UpHeron
All vulnerabilities

Servers and applications

CVE-2013-1896

mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.

Severity
Medium 4.3
Published
10 Jul 2013
Last changed
16 Jun 2026
Added to UpHeron
17 Oct 2026
Fixed in
2.2.25, 2.4.6
Sources
NVD

Affected software

SoftwareAffected versions
Apache HTTP ServerServers and applications · cpe:a:apache:http_server
  • From 2.2.0 before 2.2.25
  • From 2.4.1 before 2.4.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2013-1896
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2013-1896