Denial of Service Vulnerability in ModSecurity-Apache: CVE-2025-48866
Summary
UBUNTU-CVE-2025-48866: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Affects modsecurity-apache versions < 2.7.7-2ubuntu0.1~esm2. Fixed in 2.7.7-2ubuntu0.1~esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ModSecurity is an open-source web application firewall (WAF) engine designed to protect web applications from various attacks. It is compatible with Apache, IIS, and Nginx, providing a robust layer of security by filtering and monitoring HTTP traffic. The package 'modsecurity-apache' is widely used to enhance the security posture of web applications by implementing rules that can detect and prevent attacks. However, certain versions of this package are vulnerable to a denial of service (DoS) attack due to improper handling of arguments in its sanitization functions.
Vulnerability Detail
The vulnerability identified as CVE-2025-48866 arises from the 'sanitiseArg' (and its alias 'sanitizeArg') action within ModSecurity. This vulnerability allows an attacker to send an excessive number of arguments, potentially leading to a denial of service condition. If exploited, this could result in the web application becoming unresponsive, affecting availability and user experience. The vulnerability is present in versions prior to 2.9.10, which means that any deployment using these versions is at risk.
How To Fix
Minimum fixed version
2.7.7-2ubuntu0.1~esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade modsecurity-apacheTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using rules that contain the 'sanitiseArg' or 'sanitizeArg' action until you can update to a secure version. This will help mitigate the risk of denial of service attacks while you prepare for the update.
Conclusion
In summary, CVE-2025-48866 presents a significant denial of service vulnerability in the ModSecurity-Apache package. It is crucial for users to update to version 2.9.10 or later to mitigate this risk. Until an update can be performed, users should avoid using specific sanitization actions as a temporary measure. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for modsecurity-apache →
FAQ
CVE-2025-48866 is a denial of service vulnerability found in certain versions of the ModSecurity-Apache package, allowing attackers to exploit the sanitization functions.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities in real-time.
Exploiting this vulnerability can lead to denial of service, making your web application unresponsive and affecting user access.
Yes, the vulnerability is fixed in version 2.9.10 and later of the modsecurity-apache package. It is recommended to upgrade to this version.
If immediate updating is not possible, avoid using the 'sanitiseArg' or 'sanitizeArg' actions in your ModSecurity rules as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for modsecurity-apache.
