Denial of Service Vulnerability in ModSecurity Apache Package
Summary
CVE-2025-47947: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Affects modsecurity-apache across 2 version ranges.
< 2.9.3-3+deb11u3
< a217cb1056d9cb032c9f375d41e051723f8c23e8
Fixed in 2.9.3-3+deb11u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ModSecurity is an open-source web application firewall (WAF) engine that provides protection for web applications by filtering and monitoring HTTP traffic. It is compatible with major web servers like Apache, IIS, and Nginx. The package is widely used to enhance security by implementing rules that can detect and prevent various types of attacks. However, certain versions of ModSecurity are vulnerable to a denial of service attack when handling specific content types.
Vulnerability Detail
The vulnerability, identified as CVE-2025-47947, affects ModSecurity versions up to and including 2.9.8. It arises when the payload's content type is 'application/json' and at least one rule utilizes the 'sanitiseMatchedBytes' action. This combination can lead to a denial of service, causing the application to become unresponsive. The issue is significant as it can disrupt service availability, impacting users and potentially leading to data loss or other security concerns.
How To Fix
Minimum fixed version
2.9.3-3+deb11u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade modsecurity-apacheTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. The best course of action is to apply the patch by updating to the latest version of ModSecurity.
Conclusion
The CVE-2025-47947 vulnerability in ModSecurity poses a significant risk of denial of service under specific conditions. Users are strongly advised to update to version 2.9.9 or later to ensure their applications remain secure. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for modsecurity-apache →
FAQ
CVE-2025-47947 is a vulnerability in ModSecurity that can lead to denial of service when handling JSON payloads with specific rules.
Versions up to and including 2.9.8 of ModSecurity are vulnerable to this issue.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, a patch is available and is expected to be included in version 2.9.9 of ModSecurity.
Currently, there are no workarounds available, so it is crucial to plan for an update as soon as possible to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for modsecurity-apache.
