Critical Vulnerability in ModSecurity-Apache: HTTP Response Content-Type Override
Summary
CVE-2025-54571: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Affects modsecurity-apache across 2 version ranges.
< 2.9.3-3+deb11u5
< 6d7e8eb18f2d7d368fb8e29516fcdeaeb8d349b8
Fixed in 2.9.3-3+deb11u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ModSecurity is an open-source web application firewall (WAF) engine designed to protect web applications by filtering and monitoring HTTP traffic. It supports various web servers, including Apache, IIS, and Nginx. The package is widely used for its ability to enhance security through rules that can detect and prevent attacks. However, versions 2.9.11 and below are vulnerable to a critical issue that allows attackers to manipulate the HTTP response's Content-Type header, potentially leading to severe security risks.
Vulnerability Detail
The vulnerability identified as CVE-2025-54571 allows an attacker to override the Content-Type of HTTP responses in ModSecurity versions 2.9.11 and earlier. This flaw can lead to various security issues, including Cross-Site Scripting (XSS) attacks and the disclosure of arbitrary script source code. The vulnerability arises from improper handling of HTTP headers, which can be exploited in different scenarios, posing a significant risk to web applications relying on this WAF.
How To Fix
Minimum fixed version
2.9.3-3+deb11u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade modsecurity-apacheTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional validation on HTTP headers or restrict the use of ModSecurity rules that allow header manipulation until the package is updated.
Conclusion
The vulnerability CVE-2025-54571 in ModSecurity poses significant risks to web applications by allowing attackers to manipulate HTTP response headers. It is crucial to update to version 2.9.12 or later to mitigate these risks and ensure the security of your applications.
See every vulnerability recorded for modsecurity-apache →
FAQ
CVE-2025-54571 is a vulnerability in ModSecurity that allows attackers to override the HTTP response's Content-Type header, potentially leading to security issues.
Versions 2.9.11 and below of ModSecurity are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include XSS attacks and arbitrary script source code disclosure, which can compromise the security of web applications.
You can update ModSecurity by running the commands: sudo apt-get update followed by sudo apt-get install modsecurity-apache=2.9.12 in your terminal.
Related vulnerabilities
Recent vulnerabilities recorded for modsecurity-apache.
