https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 07:22:59 +0000 https://cve.radiocsirt.org/vuln/alsa-2025:8837 <p><strong>Affected:</strong> AlmaLinux:9: mod_security, AlmaLinux:9: mod_security-mlogc</p> <p>ModSecurity is an open source intrusion detection and prevention engine for web applications.</p> <p>Security Fix(es):</p> <p>* modsecurity: ModSecurity Has Possible DoS Vulnerability (CVE-2025-47947)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: mod_security, AlmaLinux:9: mod_security-mlogc</p> <p>ModSecurity is an open source intrusion detection and prevention engine for web applications.</p> <p>Security Fix(es):</p> <p>* modsecurity: ModSecurity Has Possible DoS Vulnerability (CVE-2025-47947)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2025:8837 https://cve.radiocsirt.org/vuln/bdu:2025-06207 bdu:2025-06207 https://cve.radiocsirt.org/vuln/bdu:2025-06207 https://cve.radiocsirt.org/vuln/bit-modsecurity-2025-47947 <p><strong>Affected:</strong> Bitnami: modsecurity</p> <p>ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload&#39;s content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.</p> <p><strong>Affected:</strong> Bitnami: modsecurity</p> <p>ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload&#39;s content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.</p> https://cve.radiocsirt.org/vuln/bit-modsecurity-2025-47947 https://cve.radiocsirt.org/vuln/euvd-2026-240910 EUVD-2026-240910 https://cve.radiocsirt.org/vuln/euvd-2026-240910 https://cve.radiocsirt.org/vuln/fkie_cve-2025-47947 <p>ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload&#39;s content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.</p> <p>ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload&#39;s content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-47947 https://cve.radiocsirt.org/vuln/oesa-2025-1559 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: mod_security</p> <p>This software is also called Modsec,it is an open-source web application firewall. It is designed for Apache HTTP Server.ModSecurity is commonly deployed to provide protections against generic classed of vulnerabilities.The install of this package is easy and you can read the README.TXT for more information. Security Fix(es):</p> <p>The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and inspected by the web application firewall engine and the rule set. The multipart payload will therefore bypass detection. A vulnerable backend that supports these encoding schemes can potentially be exploited. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised upgrade to 3.2.2 and 3.3.3 respectively. The mitigation against these vulnerabilities depends on the installation of the latest ModSecurity version (v2.9.6 / v3.0.8).(CVE-2022-39956)</p> <p>ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload&amp;apos;s content type is `application/json`, and there is at least one rule whic…</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: mod_security</p> <p>This software is also called Modsec,it is an open-source web application firewall. It is designed for Apache HTTP Server.ModSecurity is commonly deployed to provide protections against generic classed of vulnerabilities.The install of this package is easy and you can read the README.TXT for more information. Security Fix(es):</p> <p>The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and inspected by the web application firewall engine and the rule set. The multipart payload will therefore bypass detection. A vulnerable backend that supports these encoding schemes can potentially be exploited. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised upgrade to 3.2.2 and 3.3.3 respectively. The mitigation against these vulnerabilities depends on the installation of the latest ModSecurity version (v2.9.6 / v3.0.8).(CVE-2022-39956)</p> <p>ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload&amp;apos;s content type is `application/json`, and there is at least one rule whic…</p> https://cve.radiocsirt.org/vuln/oesa-2025-1559 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15197-1 <p>apache2-mod_security2-2.9.10-1.1 on GA media</p> <p>apache2-mod_security2-2.9.10-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15197-1 https://cve.radiocsirt.org/vuln/rhsa-2025:13680 <p>httpd: insufficient escaping of user-supplied data in mod_ssl httpd: mod_ssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption modsecurity: ModSecurity Has Possible DoS Vulnerability httpd: mod_proxy_http2: untrusted input from a client causes an assertion to fail in the Apache mod_proxy_http2 module httpd: HTTP Session Hijack via a TLS upgrade</p> <p>httpd: insufficient escaping of user-supplied data in mod_ssl httpd: mod_ssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption modsecurity: ModSecurity Has Possible DoS Vulnerability httpd: mod_proxy_http2: untrusted input from a client causes an assertion to fail in the Apache mod_proxy_http2 module httpd: HTTP Session Hijack via a TLS upgrade</p> https://cve.radiocsirt.org/vuln/rhsa-2025:13680 https://cve.radiocsirt.org/vuln/suse-su-2025:02029-1 <p>Security update for apache2-mod_security2</p> <p>Security update for apache2-mod_security2</p> https://cve.radiocsirt.org/vuln/suse-su-2025:02029-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-47947 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: modsecurity-apache, Ubuntu:Pro:16.04:LTS: modsecurity-apache, Ubuntu:Pro:18.04:LTS: modsecurity-apache, Ubuntu:Pro:20.04:LTS: modsecurity-apache, Ubuntu:Pro:22.04:LTS: modsecurity-apache, Ubuntu:Pro:24.04:LTS: modsecurity-apache</p> <p>ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload&#39;s content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: modsecurity-apache, Ubuntu:Pro:16.04:LTS: modsecurity-apache, Ubuntu:Pro:18.04:LTS: modsecurity-apache, Ubuntu:Pro:20.04:LTS: modsecurity-apache, Ubuntu:Pro:22.04:LTS: modsecurity-apache, Ubuntu:Pro:24.04:LTS: modsecurity-apache</p> <p>ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload&#39;s content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-47947 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1118 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OWASP ModSecurity ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OWASP ModSecurity ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1118