Denial of Service Vulnerability in ModSecurity Apache - CVE-2025-48866
Summary
CVE-2025-48866: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Affects modsecurity-apache across 2 version ranges.
< 2.9.3-3+deb11u4
< 3a54ccea62d3f7151bb08cb78d60c5e90b53ca2e
Fixed in 2.9.3-3+deb11u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ModSecurity is an open-source, cross-platform web application firewall (WAF) engine designed for Apache, IIS, and Nginx. It provides essential security features such as request filtering, logging, and real-time monitoring to protect web applications from various threats. However, certain versions of ModSecurity, specifically those prior to 2.9.10, are vulnerable to a denial of service (DoS) attack due to improper handling of excessive arguments in the sanitiseArg action.
Vulnerability Detail
The vulnerability identified as CVE-2025-48866 arises from the sanitiseArg (also known as sanitizeArg) action, which allows an attacker to submit an excessive number of arguments. This can lead to resource exhaustion, causing the web application to become unresponsive and ultimately resulting in a denial of service. The issue is similar to the previously reported GHSA-859r-vvv8-rm8r/CVE-2025-47947, highlighting a critical flaw in argument handling that could be exploited by malicious users.
How To Fix
Minimum fixed version
2.9.3-3+deb11u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade modsecurity-apacheTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using rules that contain the sanitiseArg or sanitizeArg action until you can update to the patched version. This will help mitigate the risk of denial of service attacks while you prepare for the update.
Conclusion
CVE-2025-48866 represents a significant denial of service vulnerability in ModSecurity versions prior to 2.9.10. Users are strongly advised to update to the latest version to mitigate risks. Additionally, temporary workarounds can be employed while preparing for the update. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for modsecurity-apache →
FAQ
CVE-2025-48866 is a denial of service vulnerability in ModSecurity versions prior to 2.9.10, caused by improper handling of excessive arguments in the sanitiseArg action.
If you are using a version of ModSecurity prior to 2.9.10, you are at risk. You can check your version by running modsecurity -v in your terminal.
Exploitation of this vulnerability can lead to denial of service, making your web application unresponsive and potentially affecting your users' experience.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. It requires only a manifest file like package-lock.json for real-time alerts.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for modsecurity-apache.
