Vulnerability record · CVE-2015-5259 · published 8 January 2016
CVE-2015-5259: Apache Subversion svn:// protocol integer overflow enables remote code execution
Apache · Subversion
Apache Subversion 1.9.x before 1.9.3 has an integer overflow in the read_string function in libsvn_ra_svn/marshal.c. A crafted svn:// protocol string triggers a heap-based buffer overflow and out-of-bounds read, which can lead to arbitrary code execution. The flaw is remotely reachable over the network with no authentication or user interaction.
Description
Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Automated analysis
high priorityRemote, unauthenticated code execution with a CVSS 3.0 score of 8.6 and a 99th percentile EPSS score, though not listed in KEV.
What it is
Apache Subversion 1.9.x before 1.9.3 has an integer overflow in the read_string function in libsvn_ra_svn/marshal.c. A crafted svn:// protocol string triggers a heap-based buffer overflow and out-of-bounds read, which can lead to arbitrary code execution. The flaw is remotely reachable over the network with no authentication or user interaction.
Impact
A remote attacker can corrupt heap memory and potentially execute arbitrary code in the context of the Subversion client or server process. The CVSS 3.0 vector also indicates a high availability impact, so denial of service is possible.
Attack surface
Reached over the network via the svn:// protocol by sending a malformed string to a vulnerable Subversion process. The CVSS vector shows no privileges required and no user interaction, so it is unauthenticated and remotely triggerable.
Exploitation
Not listed in CISA KEV and no public exploit or ransomware usage is documented in the record, but EPSS is 0.57037 (99th percentile), indicating a high modeled likelihood of exploitation activity.
What to do
- Upgrade Apache Subversion to 1.9.3 or later, which fixes the read_string integer overflow.
- If immediate upgrade is not possible, restrict or disable svn:// protocol access to trusted networks and hosts.
- Apply vendor or distribution patches (for example the referenced Gentoo GLSA) where a full upgrade is not yet feasible.
- Monitor Subversion server and client logs for malformed or oversized svn:// protocol strings.
Detection
- Inspect Subversion server and client logs for crashes or abnormal termination tied to svn:// connections.
- Use network monitoring to flag malformed or unusually large svn:// protocol strings reaching Subversion services.
- Watch for heap corruption indicators in process crash dumps or system logs on hosts running Subversion 1.9.x before 1.9.3.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2015-5259 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-5259), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
