CVE-2013-2765
The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a...
The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
Exploit likelihood
What each source reports
NVD Score used
The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
- Record
CVE-2013-2765- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
- Record
CVE-2013-2765- Updated
- 2026-11-02
EUVDEUVD-2013-2704 No score
The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
- Record
EUVD-2013-2704- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x49q-wq3g-gh64 No score
The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a...
The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
- Record
GHSA-x49q-wq3g-gh64- Weakness
- CWE-476
- Updated
- 2026-11-02
OSV No score
The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
- Record
CVE-2013-2765- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-2765 No score
The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
- Record
DEBIAN-CVE-2013-2765- Updated
- 2026-11-02
OSVMGASA-2013-0179 No score
apache-mod_security new security issue CVE-2013-2765
Updated apache-mod_security packages fix security vulnerability:
When ModSecurity receives a request body with a size bigger than the value set by the "SecRequestBodyInMemoryLimit" and with a "Content-Type" that has no request body processor mapped to it, ModSecurity will systematically crash on every call to "forceRequestBodyVariable" (in phase 1) (CVE-2013-2765).
- Record
MGASA-2013-0179- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10034-1 No score
apache2-mod_security2-2.9.0-5.6 on GA media
These are all security issues fixed in the apache2-mod_security2-2.9.0-5.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10034-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-2765 No score
The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
- Record
UBUNTU-CVE-2013-2765- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
modsecurity-apacheDebian:12 |
before 2.6.6-9 | 2.6.6-9 |
modsecurity-apacheDebian:13 |
before 2.6.6-9 | 2.6.6-9 |
modsecurity-apacheDebian:14 |
before 2.6.6-9 | 2.6.6-9 |
apache-mod_securityMageia:2 |
before 2.6.3-3.5.mga2 | 2.6.3-3.5.mga2 |
apache-mod_securityMageia:3 |
before 2.7.4-1.mga3 | 2.7.4-1.mga3 |
apache2-mod_security2openSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 2.9.0-5.6 | 2.9.0-5.6 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | ModSecurity - Remote Null Pointer Dereference | 2013-05-31 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2765 is a medium vulnerability (CVSS 5.0) in Trustwave Modsecurity, published June 26, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 13.7%, the 96th percentile. Fixed in modsecurity-apache 2.6.6-9.
References
sourceforge.net/mailarchive/message.php?msg_id=30900019
lists.opensuse.org/opensuse-updates/2013-08/msg00031.html
bugzilla.redhat.com/show_bug.cgi?id=967615
archives.neohapsis.com/archives/bugtraq/2013-05/0125.html
raw.github.com/SpiderLabs/ModSecurity/master/CHANGES
Show 17 moreShow less
shookalabs.com
modsecurity.org
github.com/shookalabs/exploits/blob/master/modsecurity_cve_2013_2765_check.py
nvd.nist.gov/vuln/detail/CVE-2013-2765
security-tracker.debian.org/tracker/CVE-2013-2765
advisories.mageia.org/MGASA-2013-0179.html
lists.fedoraproject.org/pipermail/package-announce/2013-June/107848.html
ubuntu.com/security/CVE-2013-2765
cve.org/CVERecord?id=CVE-2013-2765
suse.com/security/cve/CVE-2009-5031