Description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| owasp-modsecurity | ModSecurity | <= 2.9.8 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | modsecurity-apache | 2.9.9-1 | — |
| Debian 13 | modsecurity-apache | 2.9.9-1 | — |
| Debian 12 | modsecurity-apache | 2.9.7-1+deb12u1 | DSA-5940-1 |
| Debian 11 | modsecurity-apache | 2.9.3-3+deb11u3 | DLA-4192-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | modsecurity-apache | 2.9.7-1ubuntu0.24.04.1~esm1 | USN-7567-1 |
| Ubuntu Pro 22.04 LTS | modsecurity-apache | 2.9.5-1ubuntu0.1~esm2 | USN-7567-1 |
| Ubuntu Pro 20.04 LTS | modsecurity-apache | 2.9.3-1ubuntu0.1+esm1 | USN-7567-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | modsecurity-apache | 2.9.2-1ubuntu0.1~esm2 | USN-7567-1 |
| Ubuntu Pro 16.04 LTS | modsecurity-apache | 2.9.0-1ubuntu0.1~esm2 | USN-7567-1 |
| Ubuntu Pro 14.04 LTS | modsecurity-apache | 2.7.7-2ubuntu0.1~esm2 | USN-7567-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | mod_security +1 | 2.9.6-2.el9_6 | RHSA-2025:8837 |
| RHEL 8 | mod_security +1 | 2.9.6-2.el8_10 | RHSA-2025:8844 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | mod_security +1 | 2.9.6-1.el9_4.1 | RHSA-2025:8917 |
| RHEL 9.2 E4S | mod_security +1 | 2.9.6-1.el9_2.1 | RHSA-2025:8937 |
| RHEL 9.0 E4S | mod_security +1 | 2.9.3-12.el9_0.1 | RHSA-2025:8922 |
| RHEL 8.8 TUS | mod_security +1 | 2.9.6-1.el8_8.1 | RHSA-2025:8674 |
| RHEL 8.8 E4S | mod_security +1 | 2.9.6-1.el8_8.1 | RHSA-2025:8674 |
| RHEL 8.6 TUS | mod_security +1 | 2.9.2-9.el8_6.1 | RHSA-2025:8605 |
| RHEL 8.6 E4S | mod_security +1 | 2.9.2-9.el8_6.1 | RHSA-2025:8605 |
| RHEL 8.6 AUS | mod_security +1 | 2.9.2-9.el8_6.1 | RHSA-2025:8605 |
| RHEL 8.4 AUS | mod_security +1 | 2.9.2-9.el8_4.1 | RHSA-2025:8627 |
| RHEL 8.2 AUS | mod_security +1 | 2.9.2-8.el8_2.1 | RHSA-2025:8626 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-httpd +6 | 2.4.62-8.el7jbcs | RHSA-2025:13680 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_http2 | 2.0.29-5.el7jbcs | RHSA-2025:13680 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_jk +1 | 1.2.50-9.redhat_1.el7jbcs | RHSA-2025:13680 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_md | 1:2.4.28-10.el7jbcs | RHSA-2025:13680 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_proxy_cluster | 1.3.22-4.el7jbcs | RHSA-2025:13680 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_security | 2.9.6-11.el7jbcs | RHSA-2025:13680 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_ssl +1 | 1:2.4.62-8.el7jbcs | RHSA-2025:13680 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | mod_security +1 | 2.9.6-2.el9_6 | ALSA-2025:8837 |
| AlmaLinux 8 | mod_security +1 | 2.9.6-2.el8_10 | ALSA-2025:8844 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | mod_security | 2.9.6-2.el9_6 | RLSA-2025:8837 |
| Rocky Linux 8 | mod_security | 2.9.6-2.el8_10 | RLSA-2025:8844 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | apache2-mod_security2 | 2.9.4-150400.3.9.1 | SUSE-SU-2025:02028-1 |
| SLES 15 SP6 | apache2-mod_security2 | 2.9.4-150400.3.9.1 | SUSE-SU-2025:02028-1 |
| SLES 15 SP5 | apache2-mod_security2 | 2.9.4-150400.3.9.1 | SUSE-SU-2025:02028-1 |
| SLES 15 SP4 | apache2-mod_security2 | 2.9.4-150400.3.9.1 | SUSE-SU-2025:02028-1 |
| SLES 15 SP3 | apache2-mod_security2 | 2.9.2-150000.3.12.1 | SUSE-SU-2025:02029-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | apache2-mod_security2 | 2.8.0-7.9.1 | SUSE-SU-2025:02052-1 |
| SLES for SAP 15 SP5 | apache2-mod_security2 | 2.9.4-150400.3.9.1 | SUSE-SU-2025:02028-1 |
| SLES for SAP 15 SP4 | apache2-mod_security2 | 2.9.4-150400.3.9.1 | SUSE-SU-2025:02028-1 |
| SLES for SAP 15 SP3 | apache2-mod_security2 | 2.9.2-150000.3.12.1 | SUSE-SU-2025:02029-1 |
| SLE HPC 15 SP5 | apache2-mod_security2 | 2.9.4-150400.3.9.1 | SUSE-SU-2025:02028-1 |
| SLE HPC 15 SP4 | apache2-mod_security2 | 2.9.4-150400.3.9.1 | SUSE-SU-2025:02028-1 |
| SLE HPC 15 SP3 | apache2-mod_security2 | 2.9.2-150000.3.12.1 | SUSE-SU-2025:02029-1 |
| SUSE Manager Server 4.3 | apache2-mod_security2 | 2.9.4-150400.3.9.1 | SUSE-SU-2025:02028-1 |
| SUSE Manager Proxy 4.3 | apache2-mod_security2 | 2.9.4-150400.3.9.1 | SUSE-SU-2025:02028-1 |
| SUSE Enterprise Storage 7.1 | apache2-mod_security2 | 2.9.2-150000.3.12.1 | SUSE-SU-2025:02029-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2-mod_security2 | 2.9.10-1.1 | openSUSE-SU-2025:15197-1 |
| openSUSE Leap 15.6 | apache2-mod_security2 | 2.9.4-150400.3.9.1 | SUSE-SU-2025:02028-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | mod_security +1 | 2.9.10-1.amzn2023.0.1 | ALAS2023-2025-1026 |
| Amazon Linux 2 | mod_security +1 | 2.9.10-1.amzn2.0.1 | ALAS2-2025-2887 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | mod_security | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | mod_security +1 | 2.9.6-2.el9_6 | ELSA-2025-8837 |
| Oracle Linux 8 | mod_security +1 | 2.9.6-2.el8_10 | ELSA-2025-8844 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
yel1337/CVE-2025-47947 ★ 0 · Oct 1, 2026
POC for libapache2-mod-security2
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 26
- ALSA-2025:8837 Important: mod_security security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:8844 Important: mod_security security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:13680 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP1 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8937 Red Hat Security Advisory: mod_security security update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2025:8917 Red Hat Security Advisory: mod_security security update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2025:8922 Red Hat Security Advisory: mod_security security update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2025:8837 Red Hat Security Advisory: mod_security security update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2025:8844 Red Hat Security Advisory: mod_security security update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2025:8627 Red Hat Security Advisory: mod_security security update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2025:8674 Red Hat Security Advisory: mod_security security update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2025:8605 Red Hat Security Advisory: mod_security security update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2025:8626 Red Hat Security Advisory: mod_security security update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- USN-7567-1 modsecurity-apache vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- openSUSE-SU-2025:15197-1 apache2-mod_security2-2.9.10-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- DSA-5940-1 modsecurity-apache - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4192-1 modsecurity-apache - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2025:02028-1 Security update for apache2-mod_security2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02052-1 Security update for apache2-mod_security2 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1118 OWASP ModSecurity: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 4, 2025
- RLSA-2025:8837 Important: mod_security security update Rocky Linux Security Advisories · Oct 7, 2025
- RLSA-2025:8844 Important: mod_security security update Rocky Linux Security Advisories · Jul 29, 2025
- ALAS2023-2025-1026 Important: mod_security security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 23, 2025
- SUSE-SU-2025:02029-1 Security update for apache2-mod_security2 SUSE / openSUSE Security Updates · Jun 20, 2025
- ALAS2-2025-2887 Important: mod_security security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 12, 2025
- ELSA-2025-8837 Important: mod_security security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 11, 2025
- ELSA-2025-8844 Important: mod_security security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 11, 2025