CVE-2018-11803: Subversion mod_dav_svn crash via uninitialized pointer in recursive listing

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.5 availability-only denial of service with no authentication required and a very high EPSS percentile, though no confirmed in-the-wild exploitation is documented.

What it is

Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 through 1.10.3 dereference an uninitialized pointer when a client omits the root path in a recursive directory listing operation, causing the server process to crash. The flaw is a denial-of-service condition in the Apache module, not a memory-corruption path to code execution.

Impact

An attacker can crash the affected Apache HTTPD worker handling the request, disrupting Subversion service availability for other users. No confidentiality or integrity impact is described; the CVSS vector reflects availability-only impact.

Attack surface

Reached over the network through the mod_dav_svn HTTP interface by sending a recursive directory listing request that omits the root path. The CVSS vector indicates no privileges and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented. EPSS is high (0.58452, 99.055th percentile), but the references are advisories and vendor notices with no public exploit tag, so active exploitation is not confirmed by this record.

What to do

• Upgrade Subversion to a release after 1.11.0 or 1.10.3 that contains the fix; apply the vendor patch for your distribution (Apache Subversion, Ubuntu USN-3869-1, Gentoo GLSA 201904-08).
• If immediate patching is not possible, restrict or disable recursive directory listing operations on mod_dav_svn repositories where feasible.
• Limit network exposure of the Subversion HTTP service to trusted clients and place it behind an authenticated reverse proxy.
• Monitor Apache error logs for mod_dav_svn crashes and worker restarts to detect attempted or accidental triggering.

Detection

• Alert on Apache HTTPD worker crashes or segfaults tied to mod_dav_svn processes.
• Inspect HTTP access logs for PROPFIND or directory listing requests to Subversion paths that omit the root path or use unusual Depth headers.
• Correlate repeated crash-and-restart patterns on the Subversion host with requests from the same source address.
• Track Subversion server version banners or package versions to identify hosts still running 1.11.0 or 1.10.0 through 1.10.3.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.