Critical Vulnerability in ModSecurity-Apache: HTTP Response Content-Type Override
Summary
DEBIAN-CVE-2025-54571: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Affects modsecurity-apache versions < 2.9.3-3+deb11u5. Fixed in 2.9.3-3+deb11u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ModSecurity is an open-source web application firewall (WAF) engine designed to protect web applications by monitoring and filtering HTTP traffic. It is compatible with popular web servers like Apache, IIS, and Nginx. The package provides essential security features, including intrusion detection and prevention, but has been found vulnerable to an issue that allows attackers to manipulate HTTP response headers.
Vulnerability Detail
In versions 2.9.11 and below of ModSecurity, an attacker can exploit a flaw that allows them to override the HTTP response's Content-Type header. This vulnerability can lead to various security issues, including Cross-Site Scripting (XSS) attacks and the disclosure of arbitrary script source code. The root of the problem lies in improper handling of HTTP response headers, which can be manipulated by malicious actors to serve harmful content.
How To Fix
Minimum fixed version
2.9.3-3+deb11u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade modsecurity-apacheTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to sensitive endpoints or disable specific ModSecurity rules that may be exploited until the package is updated. However, this is not a long-term solution and should only be used as a stopgap.
Conclusion
The vulnerability in ModSecurity allows attackers to manipulate HTTP response headers, posing significant security risks. It is essential to update to the latest patched versions to mitigate these risks effectively. Utilizing tools like Vulert can help monitor and manage vulnerabilities in your applications.
See every vulnerability recorded for modsecurity-apache →
FAQ
Versions 2.9.11 and below are affected by this vulnerability.
Exploiting this vulnerability can lead to XSS attacks and the disclosure of sensitive script source code.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, the vulnerability is fixed in version 2.9.12 for Debian 14 and 2.9.3-3+deb11u5 for Debian 11.
Vulert monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, providing real-time insights into potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for modsecurity-apache.
