CVE-2016-2168: Apache Subversion

Medium severity, CVSS 6.5. EPSS: 19.9% chance of exploitation in the next 30 days.

The req_check_access function in the mod_authz_svn module in the httpd server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a crafted header in a (1) MOVE or (2) COPY request, involving an authorization check.

Affected products

• Apache Subversion: up to and including 1.8.15; version 1.9.0 only; version 1.9.1 only; version 1.9.2 only; version 1.9.3 only

Published 2016-05-05. Last modified 2026-06-17.