CVE-2016-2167: Apache Subversion

Medium severity, CVSS 6.8. EPSS: 6.8% chance of exploitation in the next 30 days.

The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass intended access restrictions via a realm string that is a prefix of an expected repository realm string.

Affected products

• Apache Subversion: up to and including 1.8.15; version 1.9.0 only; version 1.9.1 only; version 1.9.2 only; version 1.9.3 only

Published 2016-05-05. Last modified 2026-06-17.