CVE-2013-5704
MediumThe mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding.
Published Apr 15, 2014 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2013-5704, DLA-71-1, SUSE-SU-2015:0974-1, UBUNTU-CVE-2013-5704, UBUNTU-CVE-2014-8109, UBUNTU-CVE-2015-0228, USN-2523-1
Key Facts
Patch immediately- CVE-2013-5704 is a medium-severity vulnerability (CVSS 5.0 v2) affecting HTTP Server (Apache), Enterprise Manager Ops Center (Oracle), Jboss Enterprise Web Server (Redhat) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 53% probability of exploitation in the next 30 days.
- Fixed versions are available, including apache-commons-collections-eap6 0:3.2.1-18.redhat_7.1.ep6.el6, apache-commons-collections-eap6 0:3.2.1-18.redhat_7.1.ep6.el7, apache2 2.2.12-1.50.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
5.0
AV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS (30-day exploit likelihood)
53%
Higher than 98.9% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2013-5704 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."
Affected Products
190 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| HTTP ServerApache | 2.2.0, 2.2.10, 2.2.11, 2.2.12, 2.2.13, 2.2.14, 2.2.15, 2.2.16 | n/a |
| Enterprise Manager Ops CenterOracle | 12.1.4, 12.2.0, 12.2.1, 12.3.0 | 12.1.4 |
| Jboss Enterprise Web ServerRedhat | 2.0.0, 3.0.0 | n/a |
| Mac OS XApple | See advisory | 10.10.4 |
| Mac OS X ServerApple | See advisory | 5.0.3 |
Patched Releases
apache-commons-collections-eap6
0:3.2.1-18.redhat_7.1.ep6.el6, 0:3.2.1-18.redhat_7.1.ep6.el7
apache2
2.2.12-1.50.1, 2.2.16-6+squeeze14, 2.4.10-12.1, 2.4.10-2, 2.4.23-4.1, 2.4.7-1ubuntu4.4
apache2-devel
2.2.12-1.50.1, 2.4.10-12.1, 2.4.23-4.1
apache2-doc
2.2.12-1.50.1, 2.4.10-12.1, 2.4.23-4.1
apache2-event
2.4.23-4.1
apache2-example-pages
2.2.12-1.50.1, 2.4.10-12.1, 2.4.23-4.1
apache2-prefork
2.2.12-1.50.1, 2.4.10-12.1, 2.4.23-4.1
apache2-utils
2.2.12-1.50.1, 2.4.10-12.1, 2.4.23-4.1
apache2-worker
2.2.12-1.50.1, 2.4.10-12.1, 2.4.23-4.1
Mac OS X
10.10.4
Mac OS X Server
5.0.3
httpd
0:2.2.15-45.el6, 0:2.2.26-41.ep6.el5, 0:2.4.6-31.el7, 2.2.15-45.0.1.el6, 2.2.29-1.4.amzn1, 2.4.6-31.0.1.el7
httpd-devel
2.2.15-45.0.1.el6, 2.2.29-1.4.amzn1, 2.4.6-31.0.1.el7
httpd-manual
2.2.15-45.0.1.el6, 2.2.29-1.4.amzn1, 2.4.6-31.0.1.el7
httpd-tools
2.2.15-45.0.1.el6, 2.2.29-1.4.amzn1, 2.4.6-31.0.1.el7
httpd22
0:2.2.26-42.ep6.el7
httpd24
0:2.4.6-59.ep7.el6, 0:2.4.6-59.ep7.el7, 2.4.10-15.58.amzn1
httpd24-devel
2.4.10-15.58.amzn1
httpd24-httpd
0:2.4.6-22.el6, 0:2.4.6-25.el7, 2.4.6-22.0.1.el6
httpd24-httpd-devel
2.4.6-22.0.1.el6
httpd24-httpd-manual
2.4.6-22.0.1.el6
httpd24-httpd-tools
2.4.6-22.0.1.el6
httpd24-manual
2.4.10-15.58.amzn1
httpd24-mod_ldap
2.4.6-22.0.1.el6
httpd24-mod_proxy_html
1:2.4.6-22.0.1.el6
Timeline
Publicly disclosed
Apr 15, 2014
Last updated
Aug 4, 2026
Weakness Type
- CWE-287 Improper Authentication
References
- advisoryAPPLE-SA-2015-04-08-2
- advisoryAPPLE-SA-2015-09-16-4
- advisory[dev] 20140401 CVE-2013-5704, mod_headers and chunked trailer fields
- advisorySSRT102066
- advisoryHPSBUX03512
FAQ
Common Questions.
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding.
Affected: HTTP Server (Apache) versions 2.2.0, 2.2.10, 2.2.11, 2.2.12, 2.2.13, 2.2.14, 2.2.15, 2.2.16; Enterprise Manager Ops Center (Oracle) versions 12.1.4, 12.2.0, 12.2.1, 12.3.0; Jboss Enterprise Web Server (Redhat) versions 2.0.0, 3.0.0, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including apache-commons-collections-eap6 0:3.2.1-18.redhat_7.1.ep6.el6, apache-commons-collections-eap6 0:3.2.1-18.redhat_7.1.ep6.el7, apache2 2.2.12-1.50.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2013-5704 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo