CVE-2016-8734

subversion: unrestricted XML entity expansion in mod_dontdothat and Subversion clients using http(s)://

Loading…

Severity

Moderate

Red Hat Product Security

4.4

CVSS 3.0

Review impact separately from score.

Published · November 29, 2016

Updated · May 13, 2026

Description

Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack can cause the targeted process to consume an excessive amount of CPU resources or memory.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Only Apache+Subversion servers that have the "DontDoThatConfigFile" configuration option present are affected by this flaw. This option is not enabled in default httpd or mod_dav_svn configuration as shipped with Red Hat Enterprise Linux.

CVSS / CWE

CVSS 3.0 · 4.4
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CVSS 2.0 · 3.5
AV:N/AC:M/Au:S/C:N/I:N/A:P

CWE-776 · Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')