Description
ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | modsecurity | 3.0.6-1 | — |
| Debian 14 | modsecurity-apache | 2.9.5-1 | — |
| Debian 13 | modsecurity | 3.0.6-1 | — |
| Debian 13 | modsecurity-apache | 2.9.5-1 | — |
| Debian 12 | modsecurity | 3.0.6-1 | — |
| Debian 12 | modsecurity-apache | 2.9.5-1 | — |
| Debian 11 | modsecurity-apache | 2.9.3-3+deb11u1 | DSA-5023-1 |
| Debian 10 | modsecurity-apache | 2.9.3-1+deb10u1 | DSA-5023-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | modsecurity-apache | 2.9.1-2+deb9u1 | DLA-3031-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | modsecurity | No fix yet | — |
| Ubuntu 26.04 LTS | modsecurity | No fix yet | — |
| Ubuntu 25.10 | modsecurity | No fix yet | — |
| Ubuntu 24.04 LTS | modsecurity | No fix yet | — |
| Ubuntu 22.04 LTS | modsecurity | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | modsecurity | No fix yet | — |
| Ubuntu 20.04 LTS | modsecurity-apache | 2.9.3-1ubuntu0.1 | USN-6370-1 |
| Ubuntu Pro 22.04 LTS | modsecurity-apache | 2.9.5-1ubuntu0.1~esm1 | USN-6370-1 |
| Ubuntu Pro 18.04 LTS | modsecurity-apache | 2.9.2-1ubuntu0.1~esm1 | USN-6370-1 |
| Ubuntu Pro 16.04 LTS | modsecurity-apache | 2.9.0-1ubuntu0.1~esm1 | USN-6370-1 |
| Ubuntu Pro 14.04 LTS | modsecurity-apache | 2.7.7-2ubuntu0.1~esm1 | USN-6370-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP5 | modsecurity | 3.0.10-bp155.3.3.1 | openSUSE-SU-2023:0257-1 |
| SUSE Package Hub 15 SP4 | modsecurity | 3.0.10-bp154.2.3.1 | openSUSE-SU-2023:0269-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.5 | modsecurity | 3.0.10-bp155.3.3.1 | openSUSE-SU-2023:0257-1 |
| openSUSE Leap 15.4 | modsecurity | 3.0.10-bp154.2.3.1 | openSUSE-SU-2023:0269-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | mod_security | 2.9.7-8 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
EkamSinghWalia/Detection-and-Mitigation-script-for-CVE-2021-42717 ★ 1 · Nov 20, 2022
Detection and Mitigation script for CVE-2021-42717 -> ModSecurity DoS Vulnerability in JSON Parsing
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 9
- WID-SEC-2022-0432 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- WID-SEC-2022-0302 Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administratorrechten BSI CERT-Bund (WID) · Oct 11, 2026
- USN-6370-1 modsecurity-apache vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- DSA-5023-1 modsecurity-apache - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3031-1 modsecurity-apache - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2023:0257-1 Security update for modsecurity SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2023:0269-1 Security update for modsecurity SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-1578 Trustwave ModSecurity: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · May 1, 2024
- WID-SEC-2023-0132 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 1, 2023
References
- DSA-5023 vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-dos-vulnerability-in-json-parsing-cve-2021-42717/
- [debian-lts-announce] 20220528 [SECURITY] [DLA 3031-1] modsecurity-apache security update mailing-list