ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mod_securityUpgrade mod_security-mlogc | Jun 13, 2025 | May 21, 2025 |
| Amazon Linux Ami 2 | — | Upgrade mod_securityUpgrade mod_security-mlogcUpgrade mod_security-debuginfo | Jun 13, 2025 | May 21, 2025 |
| Amazon_linux_2023 | — | Upgrade mod_security-mlogc-debuginfoUpgrade mod_security-mlogcUpgrade mod_securityUpgrade mod_security-debuginfoUpgrade mod_security-debugsource | Jun 24, 2025 | May 21, 2025 |
| Debian | — | Upgrade modsecurity-apache | May 28, 2025 | May 21, 2025 |
| Freebsd | — | Upgrade ap24-mod_security | Jun 6, 2025 | Jun 6, 2025 |
| Oracle_linux | — | Upgrade mod_security-mlogcUpgrade mod_security | Jun 30, 2025 | May 21, 2025 |
| Redhat_linux | — | Upgrade mod_securityUpgrade mod_security-debugsourceUpgrade mod_security-mlogc-debuginfoUpgrade mod_security-debuginfoUpgrade mod_security-mlogc | Jun 12, 2025 | May 21, 2025 |
| Rocky_linux | — | Upgrade mod_security-mlogc-debuginfoUpgrade mod_securityUpgrade mod_security-debugsourceUpgrade mod_security-mlogcUpgrade mod_security-debuginfo | Sep 9, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade apache2-mod_security2 | Dec 5, 2025 | Jun 13, 2025 |
| Ubuntu | — | Upgrade libapache2-mod-security2 (Ubuntu Pro)Upgrade libapache2-mod-security2Upgrade libapache2-modsecurity (Ubuntu Pro) | Jun 17, 2025 | May 21, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub