What’s Vulnerable › Vulnerabilities

CVE-2020-17525: Remote unauthenticated denial-of-service in Subversion mod_authz_svn

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 40.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-03-17 · updated 2026-06-17
• Weakness: CWE-476

Description

Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL. This can lead to disruption for users of the service. This issue was fixed in mod_dav_svn+mod_authz_svn servers 1.14.1 and mod_dav_svn+mod_authz_svn servers 1.10.7

Affected products

• Apache Software Foundation Apache Subversion: from 1.9.0 before 1.10.7; from 1.11.0 before 1.14.1 — fixed in 1.10.7, 1.14.1
• Debian Linux: 9.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Subversion 1.10.7, 1.14.1. Check the vendor advisory for mitigations.

References

• https://lists.debian.org/debian-lts-announce/2021/05/msg00000.html
• https://subversion.apache.org/security/CVE-2020-17525-advisory.txt
• https://lists.debian.org/debian-lts-announce/2021/05/msg00000.html
• https://subversion.apache.org/security/CVE-2020-17525-advisory.txt

Get alerted when CVE-2020-17525 or the next vulnerability affects your stack