{"id":"CVE-2013-3587","aliases":["EUVD-2013-3521","GHSA-hh3m-fgxm-fq25"],"status":"published","title":"The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without...","description":"The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a \"BREACH\" attack, a different issue than CVE-2012-4929.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.06049,"percentile":0.93414,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2020-02-21T17:11:47Z","modified":"2026-06-16T23:55:28Z","products":[{"vendor":"f5","product":"arx"},{"vendor":"f5","product":"big-ip_access_policy_manager"},{"vendor":"f5","product":"big-ip_advanced_firewall_manager"},{"vendor":"f5","product":"big-ip_analytics"},{"vendor":"f5","product":"big-ip_application_acceleration_manager"},{"vendor":"f5","product":"big-ip_application_security_manager"},{"vendor":"f5","product":"big-ip_edge_gateway"},{"vendor":"f5","product":"big-ip_link_controller"},{"vendor":"f5","product":"big-ip_local_traffic_manager"},{"vendor":"f5","product":"big-ip_policy_enforcement_manager"},{"vendor":"f5","product":"big-ip_protocol_security_module"},{"vendor":"f5","product":"big-ip_wan_optimization_manager"},{"vendor":"f5","product":"big-ip_webaccelerator"},{"vendor":"f5","product":"firepass"}],"references":[{"url":"http://breachattack.com/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://security.stackexchange.com/questions/20406/is-http-compression-safe#20407","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://slashdot.org/story/13/08/05/233216","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://www.iacr.org/cryptodb/archive/2002/FSE/3091/3091.pdf","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://www.blackhat.com/us-13/briefings.html#Prado","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://github.com/meldium/breach-mitigation-rails","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://www.djangoproject.com/weblog/2013/aug/06/breach-and-django/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://www.kb.cert.org/vuls/id/987798","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://hackerone.com/reports/254895","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=995168","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://support.f5.com/csp/article/K14634","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/r7f0e9cfd166934172d43ca4c272b8bdda4a343036229d9937affd1e1%40%3Cdev.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3587"},{"url":"https://lists.apache.org/thread.html/r7f0e9cfd166934172d43ca4c272b8bdda4a343036229d9937affd1e1@%3Cdev.httpd.apache.org%3E"},{"url":"https://www.djangoproject.com/weblog/2013/aug/06/breach-and-django"},{"url":"http://breachattack.com"},{"url":"https://github.com/advisories/GHSA-hh3m-fgxm-fq25"}],"sources":{"cve":[{"id":"CVE-2013-3587","description":"The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a \"BREACH\" attack, a different issue than CVE-2012-4929.","status":"published","published":"2020-02-21T17:11:47Z","modified":"2024-08-06T16:14:56.365Z","updated_at":"2026-11-02T14:34:56.872243Z"}],"euvd":[{"id":"EUVD-2013-3521","description":"The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a \"BREACH\" attack, a different issue than CVE-2012-4929.","status":"published","published":"2020-02-21T17:11:47Z","modified":"2024-08-06T16:14:56Z","updated_at":"2026-11-03T01:56:35.141483Z"}],"ghsa":[{"id":"GHSA-hh3m-fgxm-fq25","title":"The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without...","description":"The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a \u0026quot;BREACH\u0026quot; attack, a different issue than CVE-2012-4929.","status":"published","published":"2022-05-05T00:29:40Z","modified":"2024-04-11T21:16:47Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:57:09.217628Z"}],"nvd":[{"id":"CVE-2013-3587","description":"The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a \"BREACH\" attack, a different issue than CVE-2012-4929.","status":"published","published":"2020-02-21T18:15:11.427Z","modified":"2026-06-16T23:55:28.233Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:02:52.934105Z"}]}}