CVE-2011-1783: Apache Subversion

Medium severity, CVSS 4.3. EPSS: 6.7% chance of exploitation in the next 30 days.

The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is enabled, allows remote attackers to cause a denial of service (infinite loop and memory consumption) in opportunistic circumstances by requesting data.

Affected products

• Apache Subversion: from 1.5.0, up to and including 1.5.8; from 1.6.0, before 1.6.17 (fixed in 1.6.17)
• Apple Mac OS X: before 10.7.3 (fixed in 10.7.3)
• Canonical Ubuntu Linux: version 10.04 only; version 10.10 only; version 11.04 only
• Debian Debian Linux: version 5.0 only; version 6.0 only
• Fedoraproject Fedora: version 14 only; version 15 only

Published 2011-06-06. Last modified 2026-06-16.