BIT-modsecurity2-2025-47947
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/modsecurity2/BIT-modsecurity2-2025-47947.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/BIT-modsecurity2-2025-47947
- Aliases
- Published
- 2025-05-26T07:11:20.691Z
- Modified
- 2025-05-27T15:14:44.132Z
- Summary
- ModSecurity Has Possible DoS Vulnerability
- Details
-
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is
application/json, and there is at least one rule which does asanitiseMatchedBytesaction. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available. - Database specific
{ "cpes": [ "cpe:2.3:a:trustwave:modsecurity:*:*:*:*:*:*:*:*" ], "severity": "High" }- References
Affected packages
Bitnami / modsecurity2
Package
- Name
- modsecurity2
- Purl
- pkg:bitnami/modsecurity2
Severity
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator