Modsecurity CVE-2025-48866

|

EUVD

EUVD-2025-16670 HIGH

Excessive Platform Resource Consumption within a Loop (CWE-1050)

2025-06-02 security-advisories@github.com

Denial Of Service Apache Nginx Red Hat Modsecurity Suse Owasp

7.5

CVSS 3.1 · GitHub Advisory

View

Vulnerability Assessment

Weakness	CWE CWE-1050 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Excessive platform resource consumption
Impact	CVSS 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates this is a high-impact availability attack with network accessibility, low attack complexity, and no privilege requirements. The attack is easily exploitable by any unauthenticated remote actor. While no confidentiality or integrity impact exists, the availability impact is severe, making this a critical operational risk for WAF deployments. The lack of user interaction requirement and network-based attack vector make this a practical threat. Real-world risk is substantial given that: (1) ModSecurity is a perimeter security control—its compromise directly undermines security posture; (2) DoS attacks are frequently exploited in ransomware extortion scenarios; (3) the presence of a known related CVE (CVE-2025-47947) suggests active researcher interest and potential POC availability; (4) the vulnerability is trivial to trigger (simply send many arguments in HTTP request). This should be prioritized as a critical patch given WAF's role in infrastructure protection.
Exploit ScenarioDerived	An unauthenticated attacker crafts an HTTP request (GET or POST) containing an extremely high number of parameters/arguments—for example, a GET request with 10,000+ query parameters or a POST request with equivalent form data. The request is sent to a web application protected by vulnerable ModSecurity (versions before 2.9.10). When the WAF rule engine evaluates rules containing `sanitiseArg` or `sanitizeArg` actions, these functions attempt to process all arguments without proper bounds checking. The excessive argument count causes the sanitization function to consume disproportionate CPU/memory resources, consuming all available WAF process capacity. Legitimate user requests begin timing out or failing as WAF becomes unresponsive. Multiple such requests can maintain DoS state, preventing WAF recovery. This is a trivial attack—no special tools or authentication required; a simple malformed HTTP request triggers the vulnerability. No known POC code availability mentioned in the CVE, but the simplicity and similarity to CVE-2025-47947 suggests POC development is straightforward. Attack complexity is very low (AC:L), making this a practical threat in the wild.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Mar 14, 2026

ModSecurity versions prior to 2.9.10 contain a denial of service vulnerability in the sanitiseArg and sanitizeArg actions that allows unauthenticated remote attackers to cause service disruption by submitting requests with an excessive number of arguments. This is a network-accessible DoS vulnerability with high impact on availability that affects widely-deployed WAF deployments across Apache, IIS, and Nginx platforms.

RemediationAI

Immediate actions: (1) Upgrade ModSecurity to version 2.9.10 or later (patch available); (2) Apply vendor patches from ModSecurity GitHub repository (https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.10); (3) For systems unable to patch immediately, implement workaround by disabling or removing all rules containing sanitiseArg or sanitizeArg actions—identify affected rules in active rulesets (OWASP CRS, vendor-specific rules) and remove or comment them out; (4) Implement rate limiting at upstream load balancer/proxy to limit request argument counts; (5) Monitor for exploitation attempts using WAF logs for requests with unusually high argument counts. Patch path: Update from 2.9.x to 2.9.10+ (appears to be a patch release, not requiring major version upgrade). Vendor advisory and patch details available at ModSecurity GitHub releases.

Affected VersionsENISA

ModSecurity < 2.9.10

Affected Packages

euvd modsecurity fix: 2.9.10

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

ModSecurity is a web application firewall engine that operates as a module for Apache, IIS, and Nginx web servers. The vulnerability exists in the argument sanitization functions (sanitiseArg/sanitizeArg actions) which process HTTP request parameters. The root cause (CWE-1050: Initialization with Hard-Coded Network Resource Configuration Data / similar argument handling flaw) relates to improper bounds checking or resource exhaustion handling when processing a large number of request arguments. When rules containing these actions are triggered, the WAF fails to properly limit or validate the quantity of arguments being processed, allowing an attacker to exhaust memory or processing capacity through argument multiplication attacks, similar to the related CVE-2025-47947 (GHSA-859r-vvv8-rm8r). The vulnerability affects all installations using ModSecurity 2.9.x versions before 2.9.10 on any supported platform (Apache, IIS, Nginx).

Know when Modsecurity gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Ubuntu MEDIUM

SUSE HIGH

Red Hat 5.9 MEDIUM

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

3

Patch released

Mar 14, 2026 - 16:47 nvd

Patch available

PoC Detected

Jul 02, 2025 - 18:11 vuln.today

Public exploit code

CVE Published

Jun 02, 2025 - 16:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg (and sanitizeArg - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the sanitiseArg (or sanitizeArg) action.

Executive ViewAI

Why It Matters

ModSecurity versions prior to 2.9.10 contain a denial of service vulnerability that could allow attackers to disable web application protection by exploiting the sanitiseArg/sanitizeArg actions. Organizations running affected ModSecurity instances face potential service unavailability and increased exposure to application-layer attacks during an outage.

Business Impact: High

Compensating Controls

Apply vendor patch. If immediate patching is not feasible, disable or remove any ModSecurity rules that utilize the sanitiseArg or sanitizeArg actions until the patch can be deployed.

Threat Intelligence Overview

EPSS Score

0.4%

Top 41% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

CVE.org

EPSS Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

58

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Modsecurity

View all

CVE-2025-27110 HIGH This Week POC

Libmodsecurity is one component of the ModSecurity v3 project. Rated high severity (CVSS 7.9), this vulnerability is rem

CVE-2021-42717 HIGH This Week POC

ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Rated high severity (CVSS 7.5), this vulnerabi

CVE-2020-15598 HIGH This Week POC

Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. Rated high severity (CVSS 7.5),

CVE-2019-13464 HIGH This Week POC

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Rated high severity (CVSS 7.5), this vulnerabili

CVE-2012-4528 MEDIUM This Month POC

The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver ar

CVE-2018-13065 MEDIUM This Month POC

ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. Rated medium severity (CVSS 6.1), this vulnerabili

CVE-2013-2765 MEDIUM This Month POC

The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NUL

CVE-2019-11391 MEDIUM This Month POC

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. Rated medium severity (CVSS 5.3), this v

CVE-2019-11390 MEDIUM This Month POC

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. Rated medium severity (CVSS 5.3), this v

CVE-2019-11389 MEDIUM This Month POC

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. Rated medium severity (CVSS 5.3), this v

CVE-2019-11388 MEDIUM This Month POC

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. Rated medium severity (CVSS 5.3), this v

CVE-2013-5705 MEDIUM This Month POC

apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer codi

Same weakness CWE-1050 – Excessive Platform Resource Consumption within a Loop

View all

CVE-2024-4068 HIGH POC

CVE-2021-41039 HIGH POC

CVE-2025-67419 HIGH

CVE-2026-4634 HIGH

CVE-2026-81736 HIGH

CVE-2023-1390 HIGH

CVE-2026-94287 MEDIUM

CVE-2025-32907 MEDIUM

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2011-0611 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2012-0507 CRITICAL POC

CVE-2014-1761 HIGH POC

CVE-2015-5122 CRITICAL POC

CVE-2011-0609 HIGH POC

Vendor StatusVendor

Ubuntu

Priority: Medium

modsecurity-apache

Release	Status	Version
bionic	released	2.9.2-1ubuntu0.1~esm2
focal	released	2.9.3-1ubuntu0.1+esm1
jammy	released	2.9.5-1ubuntu0.1~esm2
noble	released	2.9.7-1ubuntu0.24.04.1~esm1
oracular	released	2.9.7-1ubuntu0.24.10.1
plucky	released	2.9.8-1.1ubuntu0.1
trusty	released	2.7.7-2ubuntu0.1~esm2
upstream	released	2.9.10
xenial	released	2.9.0-1ubuntu0.1~esm2
questing	needs-triage	-

USN-7567-1

Debian

Bug #1107196

modsecurity-apache

Release	Status	Fixed Version	Urgency
bullseye	fixed	2.9.3-3+deb11u4	-
bullseye (security)	fixed	2.9.3-3+deb11u5	-
bookworm	fixed	2.9.7-1+deb12u1	-
bookworm (security)	fixed	2.9.7-1+deb12u1	-
trixie	fixed	2.9.11-1+deb13u1	-
forky, sid	fixed	2.9.12-2	-
(unstable)	fixed	2.9.10-1	-

DLA-4212-1 DSA-5940-1

SUSE

Severity: High

Product	Status
SUSE Enterprise Storage 7.1	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Fixed

References

Advisories & patches

PATCH https://github.com/owasp-modsecurity/ModSecurity/commit/3a54ccea62d3f7151bb08cb78d60c5e90b53ca2e ADVISORY https://access.redhat.com/errata/RHSA-2025:12838 ADVISORY https://access.redhat.com/errata/RHSA-2025:13670 ADVISORY https://access.redhat.com/errata/RHSA-2025:13716 ADVISORY https://access.redhat.com/errata/RHSA-2025:13775 ADVISORY https://security-tracker.debian.org/tracker/dla-4212-1 ADVISORY https://security-tracker.debian.org/tracker/dsa-5940-1 ADVISORY https://ubuntu.com/security/notices/USN-7567-1 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02028/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02029/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02052/ REF https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-859r-vvv8-rm8r REF https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v2.x)#sanitisearg REF https://lists.debian.org/debian-lts-announce/2025/06/msg00009.html

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy