Critical DoS Vulnerability in ModSecurity Package
Summary
RLSA-2025:8844: Important: mod_security security update. Affects mod_security versions < 0:2.9.6-2.el8_10. Fixed in 0:2.9.6-2.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ModSecurity is an open-source intrusion detection and prevention engine designed for web applications. It provides a robust framework for monitoring and controlling web traffic, helping to protect against various web-based attacks. The package is widely used in conjunction with web servers like Apache and Nginx to enhance security. However, it has been identified to have a critical vulnerability that could lead to denial-of-service (DoS) attacks, impacting the availability of web applications.
Vulnerability Detail
The vulnerability, identified as CVE-2025-47947, arises from a flaw in ModSecurity that could allow an attacker to exploit the system, leading to a denial of service. This could result in the web application becoming unresponsive, affecting users' access and potentially leading to data loss. The vulnerability has a CVSS score of 7.5, indicating its severity and the urgency for remediation. It is crucial for users of ModSecurity to be aware of this vulnerability and take appropriate actions to mitigate the risks associated with it.
How To Fix
Minimum fixed version
0:2.9.6-2.el8_10
This is the first release that contains the fix.
sudo dnf update mod_securityTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can implement rate limiting on their web applications to mitigate the risk of a DoS attack while waiting for the patch to be applied. This can be done by configuring the web server settings to limit the number of requests from a single IP address.
Conclusion
The identified vulnerability in ModSecurity poses a significant risk to web applications, potentially leading to denial-of-service attacks. Users are urged to update to the latest patched version to mitigate this risk. Regular monitoring and updates are essential for maintaining the security of web applications.
See every vulnerability recorded for mod_security →
FAQ
ModSecurity is an open-source web application firewall that helps protect web applications from various attacks by monitoring and filtering HTTP traffic.
CVE-2025-47947 refers to a specific vulnerability in ModSecurity that could allow for denial-of-service attacks, impacting the availability of web applications.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level that requires immediate attention.
It is recommended to regularly check for updates to ModSecurity and apply them promptly to ensure that you are protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for mod_security.
