VIR Vulnerability Intelligence Relay

CVE-2013-5704

medium
Published 2014-04-15 · Modified 2026-05-06
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
5.0

Description

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact
macos macOS Affected 1 release
VersionStatusFixed in
— Affected 10.10.4
ubuntu Ubuntu Affected 4 releases
VersionStatusFixed in
14.10 Affected —
14.04 Affected —
12.04 Affected —
10.04 Affected —
redhat Red Hat Mixed 8 releases
VersionStatusFixed in
7.7 Affected —
7.6 Affected —
7.5 Affected —
7.4 Affected —
7.3 Affected —
7.0 Affected —
6.0 Affected —
5.0 Not affected —
debian Debian Fixed 5 releases
VersionStatusFixed in
trixie Fixed 2.4.10-2
sid Fixed 2.4.10-2
forky Fixed 2.4.10-2
bullseye Fixed 2.4.10-2
bookworm Fixed 2.4.10-2

Application impact
VendorProductVersionsFixed
apache apachehttp_server2.2.0
apache apachehttp_server2.2.2
apache apachehttp_server2.2.3
apache apachehttp_server2.2.4
apache apachehttp_server2.2.5
apache apachehttp_server2.2.6
apache apachehttp_server2.2.8
apache apachehttp_server2.2.9
apache apachehttp_server2.2.10
apache apachehttp_server2.2.11
apache apachehttp_server2.2.12
apache apachehttp_server2.2.13
apache apachehttp_server2.2.14
apache apachehttp_server2.2.15
apache apachehttp_server2.2.16
apache apachehttp_server2.2.17
apache apachehttp_server2.2.18
apache apachehttp_server2.2.19
apache apachehttp_server2.2.20
apache apachehttp_server2.2.21
apache apachehttp_server2.2.22
apache apachehttp_server2.2.23
apache apachehttp_server2.2.24
apache apachehttp_server2.2.25
apache apachehttp_server2.2.26
apache apachehttp_server2.2.27
apache apachehttp_server2.4.1
apache apachehttp_server2.4.2
apache apachehttp_server2.4.3
apache apachehttp_server2.4.4
apache apachehttp_server2.4.6
apache apachehttp_server2.4.7
apache apachehttp_server2.4.9
apache apachehttp_server2.4.10
redhat redhatjboss_enterprise_web_server3.0.0
redhat redhatjboss_enterprise_web_server2.0.0
oracle oracleenterprise_manager_ops_center{"endExcluding":"12.1.4"}12.1.4
oracle oracleenterprise_manager_ops_center12.1.4
oracle oracleenterprise_manager_ops_center12.2.0
oracle oracleenterprise_manager_ops_center12.2.1
oracle oracleenterprise_manager_ops_center12.3.0
oracle oraclehttp_server10.1.3.5.0
oracle oraclehttp_server11.1.1.7.0
oracle oraclehttp_server12.1.2.0
oracle oraclehttp_server12.1.3.0

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.