Asymmetric denial of service In modsecurity-apache
Description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg (and sanitizeArg - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the sanitiseArg (or sanitizeArg) action.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 11 | 2.9.3-3+deb11u4 | ||
debian 12 | 2.9.7-1+deb12u1 | ||
debian 13 | 2.9.10-1 | ||
debian 14 | 2.9.10-1 | ||
 rpm rhel9 | 0:2.9.6-2.el9_6.1 | ||
rpm rhel8 | - | - | |
rpm rhel7 | - | - | |
rpm rhel9.4 | 0:2.9.6-1.el9_4.2 |
Aliases