Summary
ModSecurity is an open source intrusion detection and prevention engine for web applications.
Security Fix(es):
* mod_security: ModSecurity Denial of Service Vulnerability (CVE-2025-48866)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | mod_security | 0:2.9.6-2.el9_6.1 |
Vulnerabilities 1
-
High 7.5
ModSecurity has possible DoS vulnerability in sanitiseArg action
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeAr…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2369827