CVE-2013-5704

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 58.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-04-15 · updated 2026-06-16

Description

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

Affected products

Apache HTTP Server: 2.2.0, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6 (+28)
macOS: before 10.10.4 — fixed in 10.10.4
Apple Mac Os X Server: before 5.0.3 — fixed in 5.0.3
Canonical Ubuntu Linux: 10.04, 12.04, 14.04, 14.10
Oracle Corporation Enterprise Manager Ops Center: before 12.1.4; 12.1.4, 12.2.0, 12.2.1, 12.3.0 — fixed in 12.1.4
Oracle Corporation Oracle HTTP Server: 10.1.3.5.0, 11.1.1.7.0, 12.1.2.0, 12.1.3.0
Oracle Corporation Oracle Linux: 6
Oracle Corporation Solaris Operating System: 11.2
RedHat Enterprise Linux Desktop: 6.0, 7.0
RedHat Enterprise Linux Eus: 7.3, 7.4, 7.5, 7.6, 7.7
RedHat Enterprise Linux Server: 6.0, 7.0
RedHat Enterprise Linux Server Aus: 7.3, 7.4, 7.6, 7.7
RedHat Enterprise Linux Server Tus: 7.3, 7.6, 7.7
RedHat Enterprise Linux Workstation: 6.0, 7.0
Red Hat JBoss Enterprise Web Server: 3.0.0, 2.0.0

How to fix

Upgrade to a fixed version: macOS 10.10.4; Apple Mac Os X Server 5.0.3; Oracle Corporation Enterprise Manager Ops Center 12.1.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2013-5704 or the next vulnerability affects your stack