Skip to content
OpenAdvisories
Medium DLA-4294-1 1 CVE

modsecurity-apache - security update

Published Sep 7, 2025 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 modsecurity-apache 2.9.3-3+deb11u5

Vulnerabilities 1

  • Medium 6.9
    CVE-2025-54571

    ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure

    ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP sc…

    owasp-modsecurity ModSecurity modsecurity modsecurity-apache Debian Ubuntu Azure Linux