The mod_dav_svn module for the Apache HTTP Server as distributed in Apache Subversion before 1.6.17 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request for a baselined WebDAV resource as exploited in the wild in May 2011.