VIR Vulnerability Intelligence Relay

CVE-2013-5704

medium
Published 2014-04-15 · Modified 2026-05-06
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
5.0

Description

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact
OSVersionStatusFixed in
debian debianforkyfixed2.4.10-2
debian debiansidfixed2.4.10-2
debian debiantrixiefixed2.4.10-2
debian debianbookwormfixed2.4.10-2
debian debianbullseyefixed2.4.10-2
redhat rhel6.0affected
redhat rhel7.0affected
redhat rhel7.3affected
redhat rhel7.4affected
redhat rhel7.5affected
redhat rhel7.6affected
redhat rhel7.7affected
redhat rhel5.0not-affected
macos macosaffected10.10.4
ubuntu ubuntu10.04affected
ubuntu ubuntu12.04affected
ubuntu ubuntu14.04affected
ubuntu ubuntu14.10affected

Application impact
VendorProductVersionsFixed
apache apachehttp_server2.2.0
apache apachehttp_server2.2.2
apache apachehttp_server2.2.3
apache apachehttp_server2.2.4
apache apachehttp_server2.2.5
apache apachehttp_server2.2.6
apache apachehttp_server2.2.8
apache apachehttp_server2.2.9
apache apachehttp_server2.2.10
apache apachehttp_server2.2.11
apache apachehttp_server2.2.12
apache apachehttp_server2.2.13
apache apachehttp_server2.2.14
apache apachehttp_server2.2.15
apache apachehttp_server2.2.16
apache apachehttp_server2.2.17
apache apachehttp_server2.2.18
apache apachehttp_server2.2.19
apache apachehttp_server2.2.20
apache apachehttp_server2.2.21
apache apachehttp_server2.2.22
apache apachehttp_server2.2.23
apache apachehttp_server2.2.24
apache apachehttp_server2.2.25
apache apachehttp_server2.2.26
apache apachehttp_server2.2.27
apache apachehttp_server2.4.1
apache apachehttp_server2.4.2
apache apachehttp_server2.4.3
apache apachehttp_server2.4.4
apache apachehttp_server2.4.6
apache apachehttp_server2.4.7
apache apachehttp_server2.4.9
apache apachehttp_server2.4.10
redhat redhatjboss_enterprise_web_server3.0.0
redhat redhatjboss_enterprise_web_server2.0.0
oracle oracleenterprise_manager_ops_center{"endExcluding":"12.1.4"}12.1.4
oracle oracleenterprise_manager_ops_center12.1.4
oracle oracleenterprise_manager_ops_center12.2.0
oracle oracleenterprise_manager_ops_center12.2.1
oracle oracleenterprise_manager_ops_center12.3.0
oracle oraclehttp_server10.1.3.5.0
oracle oraclehttp_server11.1.1.7.0
oracle oraclehttp_server12.1.2.0
oracle oraclehttp_server12.1.3.0

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.