CVE-2025-48866

Security Fix(es):

A vulnerability was found in OWASP ModSecurity up to 2.9.9. It has been declared as critical.The manipulation of the argument sanitiseArg/sanitizeArg with an unknown input leads to a unknown weakness. The CWE definition for the vulnerability is CWE-1050. The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.As an impact it is known to affect availability.Upgrading to version 2.9.10 eliminates this vulnerability.(CVE-2025-48866)

A vulnerability was found in OWASP ModSecurity 2.9.8/2.9.10 and classified as critical.Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Impacted is availability.Upgrading to version 2.9.11 eliminates this vulnerability.(CVE-2025-52891)

ModSecurity is an open source intrusion detection and prevention engine for web applications.

Security Fix(es):

• mod_security: ModSecurity Denial of Service Vulnerability (CVE-2025-48866)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg (and sanitizeArg - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the sanitiseArg (or sanitizeArg) action.

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg (and sanitizeArg - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the sanitiseArg (or sanitizeArg) action.

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg (and sanitizeArg - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the sanitiseArg (or sanitizeArg) action.

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg (and sanitizeArg - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the sanitiseArg (or sanitizeArg) action.

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg (and sanitizeArg - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the sanitiseArg (or sanitizeArg) action.

ModSecurity Has Possible DoS Vulnerability. (CVE-2025-47947) ModSecurity has possible DoS vulnerability in sanitiseArg action. (CVE-2025-48866)

These are all security issues fixed in the apache2-mod_security2-2.9.10-1.1 package on the GA media of openSUSE Tumbleweed.

This update for apache2-mod_security2 fixes the following issues:

• CVE-2025-47947: Fixed denial of service through sanitiseMatchedBytes (bsc#1243978).
• CVE-2025-48866: Fixed denial of service via excessive number of arguments in sanitiseArg (bsc#1243976).

This update for apache2-mod_security2 fixes the following issues:

• CVE-2025-47947: Fixed denial of service through sanitiseMatchedBytes (bsc#1243978).
• CVE-2025-48866: Fixed denial of service via excessive number of arguments in sanitiseArg (bsc#1243976).

This update for apache2-mod_security2 fixes the following issues:

• CVE-2025-47947: Fixed denial of service through sanitiseMatchedBytes (bsc#1243978).
• CVE-2025-48866: Fixed denial of service via excessive number of arguments in sanitiseArg (bsc#1243976).

Simon Studer discovered that ModSecurity incorrectly handled certain JSON objects. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-47947)

It was discovered that ModSecurity incorrectly handled requests when parsing certain form data. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-48866)