CVE-2025-48866

published 2025-06-02

CVE-2025-48866: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of…

Priority P3 39 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the `sanitiseArg` (or `sanitizeArg`) action.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
debian	modsecurity-apache	< modsecurity-apache 2.9.7-1+deb12u1 (bookworm)	modsecurity-apache 2.9.7-1+deb12u1 (bookworm)
owasp	modsecurity	< 2.9.10	2.9.10

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

osv 7.5 HIGH

vendor_debian 7.5 HIGH

vendor_redhat 7.5 HIGH

vendor_ubuntu 7.5 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-1050