CVE-2007-6203: Apache HTTP Server reflects unsanitized HTTP Method in 413 error, enabling XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityCVSS score is medium (4.3) and the vulnerability requires user interaction, but public exploit code and high EPSS probability increase the risk.

What it is

Apache HTTP Server 2.0.x and 2.2.x fails to sanitize the HTTP Method specifier when reflecting it in a "413 Request Entity Too Large" error message. This allows cross-site scripting style attacks through web client components that can send arbitrary headers, similar to CVE-2006-3918.

Impact

An attacker can inject script into the error response, potentially executing code in the context of a victim's browser session. This could lead to session theft, content manipulation, or other client-side attacks.

Attack surface

The flaw is reachable over the network via a crafted HTTP request containing an invalid Content-length value that triggers the 413 error. No authentication is required, but user interaction is needed for the XSS to execute in a victim's browser.

Exploitation

Exploit code is publicly referenced, and EPSS indicates a high probability of exploitation activity, though the CVE is not listed in CISA KEV.

What to do

• Apply the latest Apache HTTP Server updates or patches that address this issue.
• Upgrade to a version of Apache HTTP Server that is no longer affected (consult vendor advisories for fixed versions).
• If patching is not immediately possible, consider using a web application firewall (WAF) to filter malicious HTTP Method headers.
• Ensure that error pages do not reflect unsanitized user input by customizing error responses.
• Monitor vendor advisories for backported fixes from distributions such as Ubuntu, Gentoo, and Apple.

Detection

• Inspect web server logs for requests with unusual or malformed HTTP Method values, especially those resulting in 413 status codes.
• Deploy network signatures to detect HTTP requests containing script tags or other XSS payloads in the Method field.
• Review error logs for repeated 413 errors from the same source, which may indicate scanning or exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.