Denial of Service Vulnerability in ModSecurity-Apache: Critical Update Required
Summary
DEBIAN-CVE-2025-47947: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Affects modsecurity-apache versions < 2.9.3-3+deb11u3. Fixed in 2.9.3-3+deb11u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ModSecurity is an open-source, cross-platform web application firewall (WAF) engine designed for Apache, IIS, and Nginx. It provides essential security features to protect web applications from various threats, including SQL injection, cross-site scripting, and other vulnerabilities. However, versions up to and including 2.9.8 are susceptible to a denial of service attack under specific conditions, particularly when handling JSON payloads with certain rules applied.
Vulnerability Detail
The vulnerability arises from the handling of payloads with the content type 'application/json' when there is at least one rule that performs the 'sanitiseMatchedBytes' action. This can lead to a denial of service, causing the application to become unresponsive. The issue has been identified in stable released versions of ModSecurity, and a patch is expected to be included in version 2.9.9. It is crucial for users to be aware of this vulnerability as it can severely impact the availability of web applications relying on ModSecurity for security.
How To Fix
Minimum fixed version
2.9.3-3+deb11u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade modsecurity-apacheTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. The best course of action is to apply the available patches as soon as they are released.
Conclusion
The ModSecurity-Apache package has a critical denial of service vulnerability that affects versions up to 2.9.8. Users are strongly advised to update to the patched versions as soon as possible to ensure the security and availability of their web applications. Regular monitoring of vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for modsecurity-apache →
FAQ
ModSecurity is an open-source web application firewall that helps protect web applications from various security threats.
Versions up to and including 2.9.8 are vulnerable to this denial of service issue.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
It is recommended to monitor the situation closely and apply the update as soon as possible, as there are currently no known workarounds.
More details can be found in the official vulnerability report at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-47947.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for modsecurity-apache.
