{"id":"CVE-2013-5705","aliases":["DEBIAN-CVE-2013-5705","DLA-34-1","DSA-2991-1","EUVD-2013-5542","GHSA-36h6-r4f5-cjrw","MGASA-2014-0180","UBUNTU-CVE-2013-5705"],"status":"published","title":"apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by...","description":"apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02722,"percentile":0.86146,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2014-04-15T10:00:00Z","modified":"2026-09-01T20:03:18Z","fixes":[{"ecosystem":"Debian:12","package":"modsecurity-apache","fixed_in":["2.7.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"modsecurity-apache","fixed_in":["2.7.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"modsecurity-apache","fixed_in":["2.7.7-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"libapache-mod-security","fixed_in":["2.5.12-1+squeeze4"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"modsecurity-apache","fixed_in":["2.6.6-6+deb7u2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"apache-mod_security","fixed_in":["2.7.4-1.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"apache-mod_security","fixed_in":["2.7.5-2.1.mga4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.7-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"libapache-mod-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.12-1+squeeze4"}]}],"versions":["2.5.12-1","2.5.12-1+squeeze1","2.5.12-1+squeeze2","2.5.12-1+squeeze3"]},{"source":"osv","ecosystem":"Debian:7","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-6+deb7u2"}]}],"versions":["2.6.6-6","2.6.6-6+deb7u1"]},{"source":"osv","ecosystem":"Mageia:3","package":"apache-mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4-1.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"apache-mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-2.1.mga4"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"trustwave","product":"modsecurity"}],"references":[{"url":"https://github.com/SpiderLabs/ModSecurity/commit/f8d441cd25172fdfe5b613442fedfc0da3cc333d","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"http://www.debian.org/security/2014/dsa-2991","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://martin.swende.se/blog/HTTPChunked.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","advisory","evidence","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-5705"},{"url":"https://github.com/advisories/GHSA-36h6-r4f5-cjrw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-5705","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0180.html","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-April/131375.html","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-5705","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-5705","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-5705","description":"apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.","status":"published","published":"2014-04-15T10:00:00Z","modified":"2024-08-06T17:22:30.145Z","updated_at":"2026-11-02T14:34:55.098814Z"}],"euvd":[{"id":"EUVD-2013-5542","description":"apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.","status":"published","published":"2014-04-15T10:00:00Z","modified":"2024-08-06T17:22:30Z","updated_at":"2026-11-03T01:56:28.286421Z"}],"ghsa":[{"id":"GHSA-36h6-r4f5-cjrw","title":"apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by...","description":"apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.","status":"published","published":"2022-05-13T01:11:43Z","modified":"2023-02-01T05:03:43Z","updated_at":"2026-11-02T14:50:06.238998Z"}],"nvd":[{"id":"CVE-2013-5705","description":"apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.","status":"published","published":"2014-04-15T10:55:11.197Z","modified":"2026-06-16T23:59:16.92Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:50.049023Z"}],"osv":[{"id":"CVE-2013-5705","description":"apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.","status":"published","published":"2014-04-15T10:55:11Z","modified":"2026-04-16T06:25:11.527904044Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-5705","description":"apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.","status":"published","published":"2014-04-15T10:55:11.197Z","modified":"2026-09-01T20:03:18.501310909Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DLA-34-1","title":"libapache-mod-security - security update","status":"published","published":"2014-08-09T00:00:00Z","modified":"2026-03-09T01:17:48.126112Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-2991-1","title":"modsecurity-apache - security update","status":"published","published":"2014-07-27T00:00:00Z","modified":"2026-03-09T01:19:13.392643Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0180","title":"Updated apache-mod_security packages fix security vulnerability","description":"Updated apache-mod_security packages fix security vulnerability:\n\nMartin Holst Swende discovered a flaw in the way mod_security handled\nchunked requests. A remote attacker could use this flaw to bypass \nintended mod_security restrictions, allowing them to send requests\ncontaining content that should have been removed by mod_security\n(CVE-2013-5705).\n","status":"published","published":"2014-04-17T20:26:15Z","modified":"2026-04-16T06:24:33.37432794Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2013-5705","description":"apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.","status":"withdrawn","published":"2014-04-15T10:55:00Z","modified":"2025-07-16T07:17:09.96296Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}