EUVD-2025-16670CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5Description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the `sanitiseArg` (or `sanitizeArg`) action.
Analysis
ModSecurity versions prior to 2.9.10 contain a denial of service vulnerability in the sanitiseArg and sanitizeArg actions that allows unauthenticated remote attackers to cause service disruption by submitting requests with an excessive number of arguments. This is a network-accessible DoS vulnerability with high impact on availability that affects widely-deployed WAF deployments across Apache, IIS, and Nginx platforms.
Technical Context
ModSecurity is a web application firewall engine that operates as a module for Apache, IIS, and Nginx web servers. The vulnerability exists in the argument sanitization functions (`sanitiseArg`/`sanitizeArg` actions) which process HTTP request parameters. The root cause (CWE-1050: Initialization with Hard-Coded Network Resource Configuration Data / similar argument handling flaw) relates to improper bounds checking or resource exhaustion handling when processing a large number of request arguments. When rules containing these actions are triggered, the WAF fails to properly limit or validate the quantity of arguments being processed, allowing an attacker to exhaust memory or processing capacity through argument multiplication attacks, similar to the related CVE-2025-47947 (GHSA-859r-vvv8-rm8r). The vulnerability affects all installations using ModSecurity 2.9.x versions before 2.9.10 on any supported platform (Apache, IIS, Nginx).
Affected Products
ModSecurity (all platforms): versions 2.9.0 through 2.9.9 inclusive. Specific affected deployments include: (1) ModSecurity for Apache (mod_security); (2) ModSecurity for IIS (ISAPI filter); (3) ModSecurity for Nginx (dynamic module or compiled-in). Any installation using ModSecurity 2.9.x prior to version 2.9.10 is vulnerable if rules containing `sanitiseArg` or `sanitizeArg` actions are active. The workaround scope is significant—many OWASP ModSecurity Core Rule Set (CRS) rules may use these actions, potentially requiring substantial ruleset modification.
Remediation
Immediate actions: (1) Upgrade ModSecurity to version 2.9.10 or later (patch available); (2) Apply vendor patches from ModSecurity GitHub repository (https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.10); (3) For systems unable to patch immediately, implement workaround by disabling or removing all rules containing `sanitiseArg` or `sanitizeArg` actions—identify affected rules in active rulesets (OWASP CRS, vendor-specific rules) and remove or comment them out; (4) Implement rate limiting at upstream load balancer/proxy to limit request argument counts; (5) Monitor for exploitation attempts using WAF logs for requests with unusually high argument counts. Patch path: Update from 2.9.x to 2.9.10+ (appears to be a patch release, not requiring major version upgrade). Vendor advisory and patch details available at ModSecurity GitHub releases.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| bionic | released | 2.9.2-1ubuntu0.1~esm2 |
| focal | released | 2.9.3-1ubuntu0.1+esm1 |
| jammy | released | 2.9.5-1ubuntu0.1~esm2 |
| noble | released | 2.9.7-1ubuntu0.24.04.1~esm1 |
| oracular | released | 2.9.7-1ubuntu0.24.10.1 |
| plucky | released | 2.9.8-1.1ubuntu0.1 |
| trusty | released | 2.7.7-2ubuntu0.1~esm2 |
| upstream | released | 2.9.10 |
| xenial | released | 2.9.0-1ubuntu0.1~esm2 |
| questing | needs-triage | - |
Debian
Bug #1107196| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 2.9.3-3+deb11u4 | - |
| bullseye (security) | fixed | 2.9.3-3+deb11u5 | - |
| bookworm | fixed | 2.9.7-1+deb12u1 | - |
| bookworm (security) | fixed | 2.9.7-1+deb12u1 | - |
| trixie | fixed | 2.9.11-1+deb13u1 | - |
| forky, sid | fixed | 2.9.12-2 | - |
| (unstable) | fixed | 2.9.10-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today