Denial of Service Vulnerability in ModSecurity-Apache: Versions Prior to 2.9.10
Summary
DEBIAN-CVE-2025-48866: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Affects modsecurity-apache versions < 2.9.3-3+deb11u4. Fixed in 2.9.3-3+deb11u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ModSecurity is an open-source, cross-platform web application firewall (WAF) engine designed for Apache, IIS, and Nginx. It provides robust security features to protect web applications from various threats, including SQL injection, cross-site scripting, and other vulnerabilities. However, certain versions of ModSecurity-Apache are susceptible to a denial of service vulnerability that can be exploited through excessive arguments in specific actions.
Vulnerability Detail
The vulnerability identified as CVE-2025-48866 affects ModSecurity-Apache versions prior to 2.9.10. It arises from the sanitiseArg (or sanitizeArg) action, which can be exploited by sending an excessive number of arguments, leading to a denial of service condition. This vulnerability is similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947, and if exploited, it can cause the web application to become unresponsive, affecting availability and user experience.
How To Fix
Minimum fixed version
2.9.3-3+deb11u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade modsecurity-apacheTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using rules that contain the sanitiseArg (or sanitizeArg) action until the package is updated to a secure version.
Conclusion
In summary, ModSecurity-Apache versions prior to 2.9.10 are vulnerable to a denial of service attack due to the sanitiseArg action. It is crucial to update to the patched versions to mitigate this risk. Additionally, users can employ workarounds until they can perform the necessary updates.
See every vulnerability recorded for modsecurity-apache →
FAQ
ModSecurity is an open-source web application firewall that helps protect web applications from various security threats.
CVE-2025-48866 is a denial of service vulnerability in ModSecurity-Apache that can be exploited by sending excessive arguments through the sanitiseArg action.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to a denial of service, causing the web application to become unresponsive and impacting user experience.
If an immediate update is not possible, avoid using the sanitiseArg (or sanitizeArg) action in your rules as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for modsecurity-apache.
