https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T03:45:59.800426+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2025:8837 ALSA-2025:8837 — Important: mod_security security update 2026-10-04T03:46:00.209675+00:00

Affected: AlmaLinux:9: mod_security, AlmaLinux:9: mod_security-mlogc

ModSecurity is an open source intrusion detection and prevention engine for web applications.

Security Fix(es):

* modsecurity: ModSecurity Has Possible DoS Vulnerability (CVE-2025-47947)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2025-06207 bdu:2025-06207 2026-10-04T03:46:00.209752+00:00 bdu:2025-06207 https://cve.radiocsirt.org/vuln/bit-modsecurity-2025-47947 BIT-modsecurity-2025-47947 — ModSecurity Has Possible DoS Vulnerability 2026-10-04T03:46:00.209772+00:00

Affected: Bitnami: modsecurity

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.

 https://cve.radiocsirt.org/vuln/euvd-2026-240910 EUVD-2026-240910 2026-10-04T03:46:00.209799+00:00 EUVD-2026-240910 https://cve.radiocsirt.org/vuln/fkie_cve-2025-47947 fkie_cve-2025-47947 2026-10-04T03:46:00.209812+00:00

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.

 https://cve.radiocsirt.org/vuln/oesa-2025-1559 OESA-2025-1559 — mod_security security update 2026-10-04T03:46:00.209836+00:00

Affected: openEuler:20.03-LTS-SP4: mod_security

This software is also called Modsec,it is an open-source web application firewall. It is designed for Apache HTTP Server.ModSecurity is commonly deployed to provide protections against generic classed of vulnerabilities.The install of this package is easy and you can read the README.TXT for more information. Security Fix(es):

The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and inspected by the web application firewall engine and the rule set. The multipart payload will therefore bypass detection. A vulnerable backend that supports these encoding schemes can potentially be exploited. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised upgrade to 3.2.2 and 3.3.3 respectively. The mitigation against these vulnerabilities depends on the installation of the latest ModSecurity version (v2.9.6 / v3.0.8).(CVE-2022-39956)

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is `application/json`, and there is at least one rule whic…

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15197-1 openSUSE-SU-2025:15197-1 — apache2-mod_security2-2.9.10-1.1 on GA media 2026-10-04T03:46:00.209874+00:00

apache2-mod_security2-2.9.10-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2025:13680 RHSA-2025:13680 — Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP1 security update 2026-10-04T03:46:00.209893+00:00

httpd: insufficient escaping of user-supplied data in mod_ssl httpd: mod_ssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption modsecurity: ModSecurity Has Possible DoS Vulnerability httpd: mod_proxy_http2: untrusted input from a client causes an assertion to fail in the Apache mod_proxy_http2 module httpd: HTTP Session Hijack via a TLS upgrade

 https://cve.radiocsirt.org/vuln/suse-su-2025:02029-1 SUSE-SU-2025:02029-1 — Security update for apache2-mod_security2 2026-10-04T03:46:00.209917+00:00

Security update for apache2-mod_security2

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-47947 UBUNTU-CVE-2025-47947 2026-10-04T03:46:00.209933+00:00

Affected: Ubuntu:Pro:14.04:LTS: modsecurity-apache, Ubuntu:Pro:16.04:LTS: modsecurity-apache, Ubuntu:Pro:18.04:LTS: modsecurity-apache, Ubuntu:Pro:20.04:LTS: modsecurity-apache, Ubuntu:Pro:22.04:LTS: modsecurity-apache, Ubuntu:Pro:24.04:LTS: modsecurity-apache

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1118 WID-SEC-W-2025-1118 — OWASP ModSecurity: Schwachstelle ermöglicht Denial of Service 2026-10-04T03:46:00.209963+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OWASP ModSecurity ausnutzen, um einen Denial of Service Angriff durchzuführen.