CVE-2025-52891
ModSecurity empty XML tag causes segmentation fault
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
ModSecurity empty XML tag causes segmentation fault
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.
- Record
CVE-2025-52891- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2025-19726
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.
- Record
EUVD-2025-19726- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
NVD
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.
- Record
CVE-2025-52891- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
ModSecurity empty XML tag causes segmentation fault
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.
- Record
CVE-2025-52891- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-52891
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.
- Record
DEBIAN-CVE-2025-52891- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-1750
mod_security security update
Security Fix(es):
A vulnerability was found in OWASP ModSecurity up to 2.9.9. It has been declared as critical.The manipulation of the argument sanitiseArg/sanitizeArg with an unknown input leads to a unknown weakness. The CWE definition for the vulnerability is CWE-1050. The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.As an impact it is known to affect availability.Upgrading to version 2.9.10 eliminates this vulnerability.(CVE-2025-48866)
A vulnerability was found in OWASP ModSecurity 2.9.8/2.9.10 and classified as critical.Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Impacted is availability.Upgrading to version 2.9.11 eliminates this vulnerability.(CVE-2025-52891)
- Record
OESA-2025-1750- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVOESA-2025-1751
mod_security security update
Security Fix(es):
A vulnerability was found in OWASP ModSecurity 2.9.8/2.9.10 and classified as critical.Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Impacted is availability.Upgrading to version 2.9.11 eliminates this vulnerability.(CVE-2025-52891)
- Record
OESA-2025-1751- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-1752
mod_security security update
Security Fix(es):
A vulnerability was found in OWASP ModSecurity 2.9.8/2.9.10 and classified as critical.Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Impacted is availability.Upgrading to version 2.9.11 eliminates this vulnerability.(CVE-2025-52891)
- Record
OESA-2025-1752- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-1753
mod_security security update
Security Fix(es):
A vulnerability was found in OWASP ModSecurity 2.9.8/2.9.10 and classified as critical.Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Impacted is availability.Upgrading to version 2.9.11 eliminates this vulnerability.(CVE-2025-52891)
- Record
OESA-2025-1753- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-1754
mod_security security update
Security Fix(es):
A vulnerability was found in OWASP ModSecurity 2.9.8/2.9.10 and classified as critical.Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Impacted is availability.Upgrading to version 2.9.11 eliminates this vulnerability.(CVE-2025-52891)
- Record
OESA-2025-1754- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-1755
mod_security security update
Security Fix(es):
A vulnerability was found in OWASP ModSecurity 2.9.8/2.9.10 and classified as critical.Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Impacted is availability.Upgrading to version 2.9.11 eliminates this vulnerability.(CVE-2025-52891)
- Record
OESA-2025-1755- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-52891
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.
- Record
UBUNTU-CVE-2025-52891- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-modsecurity-2025-52891 No score
ModSecurity empty XML tag causes segmentation fault
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.
- Record
BIT-modsecurity-2025-52891- Updated
- 2026-11-02
OSVBIT-modsecurity2-2025-52891 No score
ModSecurity empty XML tag causes segmentation fault
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.
- Record
BIT-modsecurity2-2025-52891- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15313-1 No score
apache2-mod_security2-2.9.11-1.1 on GA media
These are all security issues fixed in the apache2-mod_security2-2.9.11-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15313-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
modsecurityBitnami |
2.9.8 up to 3.0.12 | 3.0.12 |
modsecurity2Bitnami |
2.9.8 up to 2.9.11 | 2.9.11 |
modsecurity-apacheDebian:13 |
before 2.9.11-1 | 2.9.11-1 |
modsecurity-apacheDebian:14 |
before 2.9.11-1 | 2.9.11-1 |
mod_securityopenEuler:24.03-LTS-SP2 From an advisory covering 2 CVEs |
before 2.9.11-1.oe2403sp2 | 2.9.11-1.oe2403sp2 |
mod_securityopenEuler:20.03-LTS-SP4 |
before 2.9.11-1.oe2003sp4 | 2.9.11-1.oe2003sp4 |
mod_securityopenEuler:22.03-LTS-SP3 |
before 2.9.11-1.oe2203sp3 | 2.9.11-1.oe2203sp3 |
mod_securityopenEuler:22.03-LTS-SP4 |
before 2.9.11-1.oe2203sp4 | 2.9.11-1.oe2203sp4 |
mod_securityopenEuler:24.03-LTS |
before 2.9.11-1.oe2403 | 2.9.11-1.oe2403 |
mod_securityopenEuler:24.03-LTS-SP1 |
before 2.9.11-1.oe2403sp1 | 2.9.11-1.oe2403sp1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
modsecurityUbuntu:20.04:LTS |
All versions, plus listed versions 3.0.3-13.0.4-13.0.4-1build1 |
None known |
modsecurityUbuntu:22.04:LTS |
All versions, plus listed versions 3.0.4-23.0.6-1 |
None known |
modsecurityUbuntu:24.04:LTS |
All versions, plus listed versions 3.0.10-13.0.11-13.0.12-13.0.12-1.1build13.0.12-1.1build2 |
None known |
modsecurityUbuntu:25.10 |
All versions, plus listed versions 3.0.13-13.0.14-13.0.14-1build1 |
None known |
modsecurityUbuntu:26.10 |
All versions, plus listed versions 3.0.14-1build23.0.15-13.0.16-1 |
None known |
modsecurityUbuntu:26.04:LTS |
All versions, plus listed versions 3.0.14-1build13.0.14-1build2 |
None known |
apache2-mod_security2openSUSE:Tumbleweed |
before 2.9.11-1.1 | 2.9.11-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-52891 is a medium vulnerability (CVSS 6.5) in Owasp-modsecurity Modsecurity, published July 2, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in modsecurity 3.0.12.
References
github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-gw9c-4wfm-vj3x
nvd.nist.gov/vuln/detail/CVE-2025-52891
security-tracker.debian.org/tracker/CVE-2025-52891
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1750
Show 9 moreShow less
ubuntu.com/security/CVE-2025-52891
cve.org/CVERecord?id=CVE-2025-52891
suse.com/security/cve/CVE-2025-52891