Summary
Simon Studer discovered that ModSecurity incorrectly handled certain
JSON objects. An attacker could possibly use this issue to cause a denial
of service. (CVE-2025-47947)
It was discovered that ModSecurity incorrectly handled requests when
parsing certain form data. An attacker could possibly use this issue to
cause a denial of service. (CVE-2025-48866)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | modsecurity-apache | 2.7.7-2ubuntu0.1~esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | modsecurity-apache | 2.9.0-1ubuntu0.1~esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | modsecurity-apache | 2.9.2-1ubuntu0.1~esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | modsecurity-apache | 2.9.3-1ubuntu0.1+esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | modsecurity-apache | 2.9.5-1ubuntu0.1~esm2 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | modsecurity-apache | 2.9.7-1ubuntu0.24.04.1~esm1 |
Vulnerabilities 2
-
High 7.5CVE-2025-47947 Public exploit
ModSecurity Has Possible DoS Vulnerability
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content…
-
High 7.5
ModSecurity has possible DoS vulnerability in sanitiseArg action
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeAr…