CVEvulnerability

CVE-2016-8734

6.5 MEDIUM Published 2017-10-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-10-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:N/A:P
Weaknesses
CWE-400

Description

Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack can cause the targeted process to consume an excessive amount of CPU resources or memory.

Affected configurations

• apache subversion 1.4.0 • apache subversion 1.4.1 • apache subversion 1.4.2 • apache subversion 1.4.3 • apache subversion 1.4.4 • apache subversion 1.4.5 • apache subversion 1.4.6 • apache subversion 1.5.0 • apache subversion 1.5.1 • apache subversion 1.5.2 • apache subversion 1.5.3 • apache subversion 1.5.4 • apache subversion 1.5.5 • apache subversion 1.5.6 • apache subversion 1.5.7 • apache subversion 1.5.8 • apache subversion 1.6.0 • apache subversion 1.6.1 • apache subversion 1.6.2 • apache subversion 1.6.3 • apache subversion 1.6.4 • apache subversion 1.6.5 • apache subversion 1.6.6 • apache subversion 1.6.7 • apache subversion 1.6.8 • apache subversion 1.6.9 • apache subversion 1.6.10 • apache subversion 1.6.11 • apache subversion 1.6.12 • apache subversion 1.6.13 • apache subversion 1.6.14 • apache subversion 1.6.15 • apache subversion 1.6.16 • apache subversion 1.6.17 • apache subversion 1.6.18 • apache subversion 1.6.19 • apache subversion 1.6.20 • apache subversion 1.6.21 • apache subversion 1.6.23 • apache subversion 1.7.0 • apache subversion 1.7.1 • apache subversion 1.7.2 • apache subversion 1.7.3 • apache subversion 1.7.4 • apache subversion 1.7.5 • apache subversion 1.7.6 • apache subversion 1.7.7 • apache subversion 1.7.8 • apache subversion 1.7.9 • apache subversion 1.7.10 • apache subversion 1.7.11 • apache subversion 1.7.12 • apache subversion 1.7.13 • apache subversion 1.7.14 • apache subversion 1.7.15 • apache subversion 1.7.16 • apache subversion 1.7.17 • apache subversion 1.7.18 • apache subversion 1.7.19 • apache subversion 1.7.20 … and 24 more

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References