Description
The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
Exploits (1)
exploitdb
WORKING POC
by Younes JAAIDI · pythondosmultiple
https://www.exploit-db.com/exploits/25852
References (11)
Core 11
Core References
Third Party Advisory mailing-list
x_refsource_mlist
http://sourceforge.net/mailarchive/message.php?msg_id=30900019
Mailing List, Third Party Advisory vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=967615
Mailing List, Third Party Advisory vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html
Broken Link mailing-list
x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2013-05/0125.html
Broken Link x_refsource_confirm
https://raw.github.com/SpiderLabs/ModSecurity/master/CHANGES
Third Party Advisory x_refsource_misc
http://www.shookalabs.com/
Vendor Advisory x_refsource_confirm
http://www.modsecurity.org/
Exploit, Third Party Advisory x_refsource_misc
https://github.com/shookalabs/exploits/blob/master/modsecurity_cve_2013_2765_check.py
Patch, Third Party Advisory x_refsource_misc
https://github.com/SpiderLabs/ModSecurity/commit/0840b13612a0b7ef1ce7441cf811dcfc6b463fba
Mailing List, Third Party Advisory vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html
Scores
EPSS
0.0537
EPSS Percentile
90.1%
Details
CWE
CWE-476
Status
published
Products (4)
opensuse/opensuse
11.4
opensuse/opensuse
12.2
opensuse/opensuse
12.3
trustwave/modsecurity
< 2.7.4
Published
Jul 15, 2013
Tracked Since
Feb 18, 2026