CVE-2013-1896

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 29.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-07-10 · updated 2026-06-16

Description

mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.

Affected products

Apache HTTP Server: from 2.2.0 before 2.2.25; from 2.4.1 before 2.4.6 — fixed in 2.2.25, 2.4.6
Canonical Ubuntu Linux: 10.04, 12.04, 12.10, 13.04
Opensuse: 11.4, 12.2, 12.3
RedHat Enterprise Linux Desktop: 5.0, 6.0
RedHat Enterprise Linux Eus: 5.9, 6.4
RedHat Enterprise Linux Server: 5.0, 6.0
RedHat Enterprise Linux Server Aus: 5.9, 6.4
RedHat Enterprise Linux Workstation: 5.0, 6.0
Red Hat JBoss EAP: 6.0.0, 6.4.0

How to fix

Upgrade to a fixed version: Apache HTTP Server 2.2.25, 2.4.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2013-1896 or the next vulnerability affects your stack