ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the `sanitiseArg` (or `sanitizeArg`) action.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-mod_securityamazon-linux-ami-2-upgrade-mod_security-debuginfoamazon-linux-ami-2-upgrade-mod_security-mlogc | Jun 13, 2025 | Jun 2, 2025 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-mod-securityamazon-linux-2023-upgrade-mod-security-debuginfoamazon-linux-2023-upgrade-mod-security-debugsourceamazon-linux-2023-upgrade-mod-security-mlogcamazon-linux-2023-upgrade-mod-security-mlogc-debuginfo | Jun 24, 2025 | Jun 2, 2025 | |
| Debian | debian-upgrade-modsecurity-apache | Jun 4, 2025 | Jun 2, 2025 | |
| Freebsd | freebsd-upgrade-package-ap24-mod_security | Jun 8, 2025 | Jun 6, 2025 | |
| Oracle_linux | — | oracle-linux-upgrade-mod-securityoracle-linux-upgrade-mod-security-mlogc | Aug 6, 2025 | Jun 2, 2025 |
| Redhat_linux | redhat-upgrade-mod_securityredhat-upgrade-mod_security-debuginforedhat-upgrade-mod_security-debugsourceredhat-upgrade-mod_security-mlogcredhat-upgrade-mod_security-mlogc-debuginfo | Jul 9, 2025 | Jun 2, 2025 | |
| Rocky_linux | rocky-upgrade-mod_securityrocky-upgrade-mod_security-debuginforocky-upgrade-mod_security-debugsourcerocky-upgrade-mod_security-mlogcrocky-upgrade-mod_security-mlogc-debuginfo | Feb 9, 2026 | Oct 4, 2025 | |
| Suse | — | suse-upgrade-apache2-mod_security2 | Dec 5, 2025 | Aug 11, 2025 |
| Ubuntu | ubuntu-pro-upgrade-libapache2-mod-security2ubuntu-pro-upgrade-libapache2-modsecurityubuntu-upgrade-libapache2-mod-security2 | Jun 17, 2025 | Jun 2, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub