CVE-2024-46901
published 2024-12-09CVE-2024-46901: Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit…
PriorityP424medium4.3CVSS 3.1
AVNACLPRLUINSUCNINAL
EPSS
1.94%
77.9th percentile
Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository.
All versions of Subversion up to and including Subversion 1.14.4 are affected if serving repositories via mod_dav_svn. Users are recommended to upgrade to version 1.14.5, which fixes this issue.
Repositories served via other access methods are not affected.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | subversion | < 1.14.5 | 1.14.5 |
| apache | subversion | — | — |
| apache | subversion | >= 0 < 1.14.5-r0 | 1.14.5-r0 |
| apache | subversion | >= 0 < 1.14.5-r0 | 1.14.5-r0 |
| apache | subversion | >= 0 < 1.14.5-r0 | 1.14.5-r0 |
| apache | subversion | >= 0 < 1.14.5-r0 | 1.14.5-r0 |
| apache | subversion | >= 0 < 1.14.5-r0 | 1.14.5-r0 |
| apache | subversion | >= 0 < 1.14.5-r0 | 1.14.5-r0 |
| apache | subversion | >= 0 < 1.14.1-3+deb11u2 | 1.14.1-3+deb11u2 |
| apache | subversion | >= 0 < 1.14.2-4+deb12u1 | 1.14.2-4+deb12u1 |
| apache | subversion | >= 0 < 1.14.5-1 | 1.14.5-1 |
| apache | subversion | >= 0 < 1.14.5-1 | 1.14.5-1 |
| apache_software_foundation | apache_subversion | <= 1.14.4 | — |
| debian | debian_linux | — | — |
| debian | subversion | < subversion 1.14.2-4+deb12u1 (bookworm) | subversion 1.14.2-4+deb12u1 (bookworm) |
| msrc | azl3_subversion_1.14.3-2_on_azure_linux_3.0 | — | — |
| msrc | cbl2_subversion_1.14.2-2_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
osv4.3MEDIUM
vendor_oracle4.3LOW
vendor_apache3.1LOW
vendor_debian3.1LOW
vendor_msrc3.1LOW
vendor_redhat3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2024-46901: Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users wi
osv·2024-12-09·CVSS 4.3
CVE-2024-46901 [MEDIUM] CVE-2024-46901: Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users wi
Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository.
All versions of Subversion up to and including Subversion 1.14.4 are affected if serving repositories via mod_dav_svn. Users are recommended to upgrade to version 1.14.5, which fixes this issue.
Repositories served via other access methods are not affected.
OSV
CVE-2024-46901: Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users wi
osv·2024-12-09·CVSS 4.3
CVE-2024-46901 [MEDIUM] CVE-2024-46901: Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users wi
Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository. All versions of Subversion up to and including Subversion 1.14.4 are affected if serving repositories via mod_dav_svn. Users are recommended to upgrade to version 1.14.5, which fixes this issue. Repositories served via other access methods are not affected.
GHSA
GHSA-53gr-8h72-9w7p: Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users wi
ghsa_unreviewed·2024-12-09
CVE-2024-46901 [LOW] CWE-20 GHSA-53gr-8h72-9w7p: Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users wi
Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository.
All versions of Subversion up to and including Subversion 1.14.4 are affected if serving repositories via mod_dav_svn. Users are recommended to upgrade to version 1.14.5, which fixes this issue.
Repositories served via other access methods are not affected.
Oracle
Oracle Oracle Communications Risk Matrix: Core (Apache Subversion) — CVE-2024-46901
vendor_oracle·2026-01-15·CVSS 4.3
CVE-2024-46901 [LOW] Oracle Oracle Communications Risk Matrix: Core (Apache Subversion) — CVE-2024-46901
Oracle Oracle Communications Risk Matrix: Core (Apache Subversion) vulnerability
CVE: CVE-2024-46901
CVSS: 4.3
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujan2026 (JAN 2026)
Ubuntu
Apache Subversion vulnerability
vendor_ubuntu·2025-10-16
CVE-2024-46901 Apache Subversion vulnerability
Title: Apache Subversion vulnerability
Summary: Apache Subversion could be made to crash if it opened a specially crafted
file.
USN-7818-1 fixed vulnerabilities in Apache Subversion. This update provides
the corresponding update for Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, and Ubuntu 24.04 LTS.
Original advisory details:
It was discovered that Apache Subversion incorrectly parsed control
characters in filenames. An attacker could possibly use this issue to
commit a corrupted revision to a repository, leading to a denial of
service.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Apache Subversion vulnerability
vendor_ubuntu·2025-10-13
CVE-2024-46901 Apache Subversion vulnerability
Title: Apache Subversion vulnerability
Summary: Apache Subversion could be made to crash if it opened a specially crafted
file.
It was discovered that Apache Subversion incorrectly parsed control
characters in filenames. An attacker could possibly use this issue to
commit a corrupted revision to a repository, leading to a denial of
service.
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
Apache Subversion: mod_dav_svn denial-of-service via control characters in paths
vendor_msrc·2024-12-10·CVSS 3.1
CVE-2024-46901 [LOW] CWE-20 Apache Subversion: mod_dav_svn denial-of-service via control characters in paths
Apache Subversion: mod_dav_svn denial-of-service via control characters in paths
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
apache: apache
Customer Action Required: Yes
Remediation: CBL-Mariner Release
Red Hat
Subversion: Apache Subversion: mod_dav_svn denial-of-service via control characters in paths
vendor_redhat·2024-12-09·CVSS 3.1
CVE-2024-46901 [LOW] CWE-116 Subversion: Apache Subversion: mod_dav_svn denial-of-service via control characters in paths
Subversion: Apache Subversion: mod_dav_svn denial-of-service via control characters in paths
Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository.
All versions of Subversion up to and including Subversion 1.14.4 are affected if serving repositories via mod_dav_svn. Users are recommended to upgrade to version 1.14.5, which fixes this issue.
Repositories served via other access methods are not affected.
A flaw was found in Apache Subversion when serving repositories via mod_dav_svn. This issue may allow authenticated users with commit access to commit a corrupted revision, leading to disruption fo
Debian
CVE-2024-46901: subversion - Insufficient validation of filenames against control characters in Apache Subver...
vendor_debian·2024·CVSS 3.1
CVE-2024-46901 [LOW] CVE-2024-46901: subversion - Insufficient validation of filenames against control characters in Apache Subver...
Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository. All versions of Subversion up to and including Subversion 1.14.4 are affected if serving repositories via mod_dav_svn. Users are recommended to upgrade to version 1.14.5, which fixes this issue. Repositories served via other access methods are not affected.
Scope: local
bookworm: resolved (fixed in 1.14.2-4+deb12u1)
bullseye: resolved (fixed in 1.14.1-3+deb11u2)
forky: resolved (fixed in 1.14.5-1)
sid: resolved (fixed in 1.14.5-1)
trixie: resolved (fixed in 1.14.5-1)
Apache
Apache subversion: CVE-2024-46901
vendor_apache·CVSS 3.1
CVE-2024-46901 [LOW] Apache subversion: CVE-2024-46901
Apache subversion: CVE-2024-46901
-advisory.txt [ PGP ] 1.0.0-1.14.4 mod_dav_svn denial-of-service via control characters in paths
No detection rules found.
No public exploits indexed.
2024-12-09
Published