CVE-2013-6438

CVE-2013-6438 describes a denial-of-service vulnerability in the mod_dav module of the Apache HTTP Server, affecting versions prior to 2.4.8, as well as various distributions including Ubuntu and Oracle. The flaw lies in the dav_xml_get_cdata function's improper handling of whitespace in CDATA sections, allowing a remote attacker to crash the daemon via a specially crafted DAV WRITE request. This vulnerability has a CVSS score of 5.0, indicating a medium severity. It is easily exploitable over the network with low attack complexity and requires no authentication, leading to a partial availability impact (daemon crash). Despite its age, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. While there's limited community discussion and media coverage, the vulnerability is not listed on the CISA KEV catalog, suggesting it's not a prevalent threat.