CVE-2022-24070: Apache Subversion

High severity, CVSS 7.5. EPSS: 9.5% chance of exploitation in the next 30 days.

Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory which has already been freed. Affected Subversion mod_dav_svn servers 1.10.0 through 1.14.1 (inclusive). Servers that do not use mod_dav_svn are not affected.

Affected products

• Apache Subversion: from 1.10.0, before 1.10.8 (fixed in 1.10.8); from 1.14.0, before 1.14.2 (fixed in 1.14.2)
• Apple macOS: from 12.0, before 12.5 (fixed in 12.5)
• Debian Debian Linux: version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 35 only; version 36 only

Published 2022-04-12. Last modified 2026-06-17.