Segmentation Fault in ModSecurity Apache due to Empty XML Tags
Summary
CVE-2025-52891: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Affects modsecurity-apache across 2 version ranges.
< 2.9.11-1
< ecd7b9736836eee391d25f35d5bd06a3ce35a45d
Fixed in 2.9.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ModSecurity is an open-source web application firewall (WAF) engine that operates across various platforms, including Apache, IIS, and Nginx. It is designed to protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet. The package is widely used for its ability to detect and prevent various types of attacks, such as SQL injection and cross-site scripting. However, certain versions of ModSecurity are vulnerable to a segmentation fault when processing XML requests with empty tags, which can lead to application crashes and service disruptions.
Vulnerability Detail
The vulnerability identified as CVE-2025-52891 affects ModSecurity versions 2.9.8 to before 2.9.11. It arises when the SecParseXmlIntoArgs directive is set to 'On' or 'OnlyArgs' and the request type is 'application/xml'. If at least one XML tag is empty (e.g., <foo></foo>), the application encounters a segmentation fault, resulting in a crash. This issue can disrupt service availability and compromise the security posture of applications relying on ModSecurity for protection.
How To Fix
Minimum fixed version
2.9.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade modsecurity-apacheTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the SecParseXmlIntoArgs directive by setting it to 'Off' in your ModSecurity configuration file. Add the following line to your configuration: 'SecParseXmlIntoArgs Off'. This will prevent the segmentation fault from occurring while you work on updating to the patched version.
Conclusion
CVE-2025-52891 presents a significant risk for users of ModSecurity versions 2.9.8 to before 2.9.11, as it can lead to application crashes when processing certain XML requests. It is crucial to update to version 2.9.11 or later to mitigate this risk. In the meantime, disabling the SecParseXmlIntoArgs directive can serve as a temporary measure.
See every vulnerability recorded for modsecurity-apache →
FAQ
CVE-2025-52891 is a vulnerability in ModSecurity that causes a segmentation fault when processing XML requests with empty tags.
Versions 2.9.8 to before 2.9.11 of ModSecurity are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, you can disable the SecParseXmlIntoArgs directive as a temporary workaround.
More information about ModSecurity can be found on its official website or its GitHub repository.
Related vulnerabilities
Recent vulnerabilities recorded for modsecurity-apache.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
