CVE-2013-2254
Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Sling
CVE-2013-2254 is a medium vulnerability (CVSS 5.0) in Apache Org.apache.sling.servlets.post, published October 17, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.09%, the 90th percentile. Fixed in org.apache.sling:org.apache.sling.api 2.4.0.
The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.
- Record
CVE-2013-2254- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.
- Record
CVE-2013-2254- Updated
- 2026-11-02
EUVDEUVD-2022-3665 No score
The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.
- Record
EUVD-2022-3665- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cxwh-vmhg-39r2 No score
Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Sling
The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.
- Record
GHSA-cxwh-vmhg-39r2- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVGHSA-cxwh-vmhg-39r2 No score
Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Sling
The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.
- Record
GHSA-cxwh-vmhg-39r2- Weakness
- CWE-119
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.sling:org.apache.sling.apiMaven |
through 2.3.0 | 2.4.0 |
org.apache.sling:org.apache.sling.apiMaven |
before 2.4.0, plus listed versions 2.0.2-incubator2.0.4-incubator2.0.62.0.82.1.0 Show 4 moreShow less2.2.02.2.22.2.42.3.0 |
2.4.0 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
mail-archives.apache.org/mod_mbox/sling-dev/201310.mbox/%3CCAKkCf4pue6PnESsP1KTdEDJm1gpkANFaK%2BvUd9mzEVT7tXL%2B3A%40mail.gmail.com%3E
secunia.com/advisories/55157
securityfocus.com/bid/62903
issues.apache.org/jira/browse/SLING-2913
exchange.xforce.ibmcloud.com/vulnerabilities/87765
nvd.nist.gov/vuln/detail/CVE-2013-2254
github.com/advisories/GHSA-cxwh-vmhg-39r2