Every CVE Search/ Get API key

CVE-2013-6438

The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server...

5.0 MediumFix available

The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.

Exploit likelihood

27.5%Up 20.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.

Record
CVE-2013-6438
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated
2026-11-02
CVE List No score

The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.

Record
CVE-2013-6438
Updated
2026-11-02
EUVDEUVD-2013-6247 No score

The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.

Record
EUVD-2013-6247
Updated
2026-11-03
GitHub AdvisoriesGHSA-2xpp-q4gq-7cc3 No score

The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server...

The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.

Record
GHSA-2xpp-q4gq-7cc3
Weakness
CWE-20
Updated
2026-11-02
OSVBELL-CVE-2013-6438 5.0

CVE-2013-6438 does not affect BellSoft software

Record
BELL-CVE-2013-6438
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated
2026-11-02
OSV No score

The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.

Record
CVE-2013-6438
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2013-6438 No score

The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.

Record
DEBIAN-CVE-2013-6438
Updated
2026-11-02
OSVMGASA-2014-0135 No score

Updated apache packages fix security vulnerabilities

Apache HTTPD before 2.4.9 was vulnerable to a denial of service in mod_dav when handling DAV_WRITE requests (CVE-2013-6438).

Apache HTTPD before 2.4.9 was vulnerable to a denial of service when logging cookies (CVE-2014-0098).

Record
MGASA-2014-0135
Updated
2026-11-02
OSVopenSUSE-SU-2024:10268-1 No score

apache2-2.4.23-4.1 on GA media

These are all security issues fixed in the apache2-2.4.23-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10268-1
Updated
2026-11-02
OSVSUSE-SU-2015:0689-1 No score

Recommended update for apache2

This update for the Apache Web Server introduces directives to control two protocol options:

* HttpContentLengthHeadZero: Allow responses to HEAD request with
  Content-Length of 0
* HttpExpectStrict: Allow the administrator to control whether clients
  must send '100-continue'

MODULE_MAGIC_NUMBER_MINOR has been increased to 24, as this change is not forward-compatible. Modules built against this release might not work correctly with older releases of the Apache Web Server.

Record
SUSE-SU-2015:0689-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache2
Debian:12
 before 2.4.9-1
2.4.9-1
apache2
Debian:13
 before 2.4.9-1
2.4.9-1
apache2
Debian:14
 before 2.4.9-1
2.4.9-1
apache2
Debian:6.0
 before 2.2.16-6+squeeze13, plus listed versions
2.2.16-62.2.16-6+squeeze12.2.16-6+squeeze102.2.16-6+squeeze112.2.16-6+squeeze12
Show 9 moreShow less
2.2.16-6+squeeze1~bpo50+12.2.16-6+squeeze22.2.16-6+squeeze2~bpo50+12.2.16-6+squeeze32.2.16-6+squeeze42.2.16-6+squeeze4~bpo50+12.2.16-6+squeeze62.2.16-6+squeeze72.2.16-6+squeeze8
2.2.16-6+squeeze13
apache
Mageia:3
 before 2.4.4-7.6.mga3
2.4.4-7.6.mga3
apache
Mageia:4
 before 2.4.7-5.1.mga4
2.4.7-5.1.mga4
httpd
Red Hat:enterprise_linux:5::client
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
httpd-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
mod_ssl
Red Hat:enterprise_linux:5::client
 before 1:2.2.3-85.el5_10
1:2.2.3-85.el5_10
httpd
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
Show 54 moreShow less
Affected packages
PackageAffectedFixed
httpd-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
httpd-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
httpd-manual
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
httpd
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
httpd-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
httpd-devel
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
httpd-manual
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
mod_ssl
Red Hat:enterprise_linux:5::server
 before 1:2.2.3-85.el5_10
1:2.2.3-85.el5_10
httpd
Red Hat:enterprise_linux:6::client
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-tools
Red Hat:enterprise_linux:6::client
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-devel
Red Hat:enterprise_linux:6::client
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-manual
Red Hat:enterprise_linux:6::client
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
mod_ssl
Red Hat:enterprise_linux:6::client
 before 1:2.2.15-30.el6_5
1:2.2.15-30.el6_5
httpd
Red Hat:enterprise_linux:6::computenode
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-tools
Red Hat:enterprise_linux:6::computenode
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-devel
Red Hat:enterprise_linux:6::computenode
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-manual
Red Hat:enterprise_linux:6::computenode
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
mod_ssl
Red Hat:enterprise_linux:6::computenode
 before 1:2.2.15-30.el6_5
1:2.2.15-30.el6_5
httpd
Red Hat:enterprise_linux:6::server
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-devel
Red Hat:enterprise_linux:6::server
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-manual
Red Hat:enterprise_linux:6::server
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-tools
Red Hat:enterprise_linux:6::server
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
mod_ssl
Red Hat:enterprise_linux:6::server
 before 1:2.2.15-30.el6_5
1:2.2.15-30.el6_5
httpd
Red Hat:enterprise_linux:6::workstation
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-devel
Red Hat:enterprise_linux:6::workstation
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-manual
Red Hat:enterprise_linux:6::workstation
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-tools
Red Hat:enterprise_linux:6::workstation
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
mod_ssl
Red Hat:enterprise_linux:6::workstation
 before 1:2.2.15-30.el6_5
1:2.2.15-30.el6_5
httpd
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:2.2.22-27.ep6.el5
0:2.2.22-27.ep6.el5
httpd-devel
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:2.2.22-27.ep6.el5
0:2.2.22-27.ep6.el5
httpd-manual
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:2.2.22-27.ep6.el5
0:2.2.22-27.ep6.el5
httpd-tools
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:2.2.22-27.ep6.el5
0:2.2.22-27.ep6.el5
mod_ssl
Red Hat:jboss_enterprise_web_server:2::el5
 before 1:2.2.22-27.ep6.el5
1:2.2.22-27.ep6.el5
httpd
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:2.2.22-27.ep6.el6
0:2.2.22-27.ep6.el6
httpd-debuginfo
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:2.2.22-27.ep6.el6
0:2.2.22-27.ep6.el6
httpd-devel
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:2.2.22-27.ep6.el6
0:2.2.22-27.ep6.el6
httpd-manual
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:2.2.22-27.ep6.el6
0:2.2.22-27.ep6.el6
httpd-tools
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:2.2.22-27.ep6.el6
0:2.2.22-27.ep6.el6
mod_ssl
Red Hat:jboss_enterprise_web_server:2::el6
 before 1:2.2.22-27.ep6.el6
1:2.2.22-27.ep6.el6
httpd
Red Hat:jboss_enterprise_application_platform:6::el5
 before 0:2.2.22-27.ep6.el5
0:2.2.22-27.ep6.el5
httpd-debuginfo
Red Hat:jboss_enterprise_application_platform:6::el5
 before 0:2.2.22-27.ep6.el5
0:2.2.22-27.ep6.el5
httpd-devel
Red Hat:jboss_enterprise_application_platform:6::el5
 before 0:2.2.22-27.ep6.el5
0:2.2.22-27.ep6.el5
httpd-tools
Red Hat:jboss_enterprise_application_platform:6::el5
 before 0:2.2.22-27.ep6.el5
0:2.2.22-27.ep6.el5
mod_ssl
Red Hat:jboss_enterprise_application_platform:6::el5
 before 1:2.2.22-27.ep6.el5
1:2.2.22-27.ep6.el5
httpd
Red Hat:jboss_enterprise_application_platform:6::el6
 before 0:2.2.22-27.ep6.el6
0:2.2.22-27.ep6.el6
httpd-debuginfo
Red Hat:jboss_enterprise_application_platform:6::el6
 before 0:2.2.22-27.ep6.el6
0:2.2.22-27.ep6.el6
httpd-devel
Red Hat:jboss_enterprise_application_platform:6::el6
 before 0:2.2.22-27.ep6.el6
0:2.2.22-27.ep6.el6
httpd-tools
Red Hat:jboss_enterprise_application_platform:6::el6
 before 0:2.2.22-27.ep6.el6
0:2.2.22-27.ep6.el6
mod_ssl
Red Hat:jboss_enterprise_application_platform:6::el6
 before 1:2.2.22-27.ep6.el6
1:2.2.22-27.ep6.el6
apache2
openSUSE:Tumbleweed
 before 2.4.23-4.1
2.4.23-4.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-6438 is a medium vulnerability (CVSS 5.0) in Apache Http Server, published March 18, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 27.5%, the 98th percentile. Fixed in apache2 2.4.9-1.

References

Show 152 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open