Most recent entries from all

bdu:2026-00351

BIT-modsecurity-2025-52891 — ModSecurity empty XML tag causes segmentation fault

Affected: Bitnami: modsecurity

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.

EUVD-2026-246343

fkie_cve-2025-52891

OESA-2025-1750 — mod_security security update

Affected: openEuler:24.03-LTS-SP2: mod_security

Security Fix(es):

A vulnerability was found in OWASP ModSecurity up to 2.9.9. It has been declared as critical.The manipulation of the argument sanitiseArg/sanitizeArg with an unknown input leads to a unknown weakness. The CWE definition for the vulnerability is CWE-1050. The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.As an impact it is known to affect availability.Upgrading to version 2.9.10 eliminates this vulnerability.(CVE-2025-48866)

A vulnerability was found in OWASP ModSecurity 2.9.8/2.9.10 and classified as critical.Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Impacted is availability.Upgrading to version 2.9.11 eliminates this vulnerability.(CVE-2025-52891)

openSUSE-SU-2025:15313-1 — apache2-mod_security2-2.9.11-1.1 on GA media

apache2-mod_security2-2.9.11-1.1 on GA media

UBUNTU-CVE-2025-52891

Affected: Ubuntu:20.04:LTS: modsecurity, Ubuntu:22.04:LTS: modsecurity, Ubuntu:24.04:LTS: modsecurity, Ubuntu:25.10: modsecurity, Ubuntu:26.04:LTS: modsecurity

WID-SEC-W-2025-1441 — OWASP ModSecurity: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OWASP ModSecurity ausnutzen, um einen Denial of Service Angriff durchzuführen.