Segmentation Fault in ModSecurity-Apache Due to Empty XML Tags
Summary
DEBIAN-CVE-2025-52891: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Affects modsecurity-apache versions < 2.9.11-1. Fixed in 2.9.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ModSecurity is an open-source, cross-platform web application firewall (WAF) engine designed for Apache, IIS, and Nginx. It provides essential security features such as intrusion detection, prevention, and real-time monitoring of web traffic. The package is widely used to protect web applications from various threats, but it is vulnerable to specific issues that can lead to application crashes or data exposure.
Vulnerability Detail
The vulnerability arises in ModSecurity versions 2.9.8 to before 2.9.11, where an empty XML tag can trigger a segmentation fault. This occurs when the SecParseXmlIntoArgs directive is set to On or OnlyArgs, and the request type is application/xml. If at least one XML tag is empty (e.g., <foo></foo>), it results in a segmentation fault, potentially leading to service disruption and denial of access to the web application.
How To Fix
Minimum fixed version
2.9.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade modsecurity-apacheTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the parsing of XML arguments by setting the SecParseXmlIntoArgs directive to Off in your ModSecurity configuration file. This can be done by adding the following line: SecParseXmlIntoArgs Off
Conclusion
The segmentation fault vulnerability in ModSecurity-Apache due to empty XML tags poses a significant risk to web applications. It is crucial to update to the patched version 2.9.11-1 or later to mitigate this risk. Additionally, using workarounds and tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for modsecurity-apache →
FAQ
Versions 2.9.8 to before 2.9.11 are affected by this vulnerability.
Failure to address this vulnerability may lead to segmentation faults, causing your web application to crash and become inaccessible.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, the permanent fix is to update to version 2.9.11-1 or later of the ModSecurity-Apache package.
Vulert monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. It provides real-time insights into vulnerabilities affecting your applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for modsecurity-apache.
