{"id":"CVE-2025-48866","aliases":["AZL-62229","AZL-62231","BIT-modsecurity-2025-48866","BIT-modsecurity2-2025-48866","DEBIAN-CVE-2025-48866","DLA-4212-1","DSA-5940-1","EUVD-2025-16670","MGASA-2025-0192","OESA-2025-1676","OESA-2025-1750","RHSA-2025:12838","RHSA-2025:13670","RHSA-2025:13716","RHSA-2025:13775","RLSA-2025:12838","SUSE-SU-2025:02028-1","SUSE-SU-2025:02029-1","SUSE-SU-2025:02052-1","UBUNTU-CVE-2025-48866","USN-7567-1","openSUSE-SU-2025:15197-1"],"status":"published","title":"ModSecurity has possible DoS vulnerability in sanitiseArg action","description":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the  `sanitiseArg` (or `sanitizeArg`) action.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00867,"percentile":0.5897,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1050"],"published":"2025-06-02T15:46:19Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Bitnami","package":"modsecurity","fixed_in":["3.0.12"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"modsecurity2","fixed_in":["2.9.10"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"modsecurity-apache","fixed_in":["2.9.7-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"modsecurity-apache","fixed_in":["2.9.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"modsecurity-apache","fixed_in":["2.9.10-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"modsecurity-apache","fixed_in":["2.9.3-3+deb11u4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"mod_security","fixed_in":["2.9.9-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"mod_security","fixed_in":["2.9.9-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"mod_security","fixed_in":["2.9.9-2.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"mod_security","fixed_in":["2.9.9-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"mod_security","fixed_in":["2.9.9-2.oe2403"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_security","fixed_in":["0:2.9.6-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_security-debuginfo","fixed_in":["0:2.9.6-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_security-debugsource","fixed_in":["0:2.9.6-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_security-mlogc","fixed_in":["0:2.9.6-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_security-mlogc-debuginfo","fixed_in":["0:2.9.6-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_security","fixed_in":["0:2.9.6-1.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_security-debuginfo","fixed_in":["0:2.9.6-1.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_security-debugsource","fixed_in":["0:2.9.6-1.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_security-mlogc","fixed_in":["0:2.9.6-1.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_security-mlogc-debuginfo","fixed_in":["0:2.9.6-1.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"mod_security","fixed_in":["0:2.9.3-12.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"mod_security-debuginfo","fixed_in":["0:2.9.3-12.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"mod_security-debugsource","fixed_in":["0:2.9.3-12.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"mod_security-mlogc","fixed_in":["0:2.9.3-12.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"mod_security-mlogc-debuginfo","fixed_in":["0:2.9.3-12.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_security","fixed_in":["0:2.9.6-1.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_security-debuginfo","fixed_in":["0:2.9.6-1.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_security-debugsource","fixed_in":["0:2.9.6-1.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_security-mlogc","fixed_in":["0:2.9.6-1.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_security-mlogc-debuginfo","fixed_in":["0:2.9.6-1.el9_2.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"mod_security","fixed_in":["0:2.9.6-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"modsecurity-apache","fixed_in":["2.7.7-2ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"modsecurity-apache","fixed_in":["2.9.0-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"modsecurity-apache","fixed_in":["2.9.2-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"modsecurity-apache","fixed_in":["2.9.3-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"modsecurity-apache","fixed_in":["2.9.5-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"modsecurity-apache","fixed_in":["2.9.7-1ubuntu0.24.04.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.9.4-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.9.7-8"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"modsecurity","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.12"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"modsecurity2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.9.10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-1+deb12u1"}]}],"versions":["2.9.7-1"]},{"source":"osv","ecosystem":"Debian:13","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-3+deb11u4"}]}],"versions":["2.9.3-3","2.9.3-3+deb11u1","2.9.3-3+deb11u2","2.9.3-3+deb11u3"]},{"source":"osv","ecosystem":"Debian:12","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-1+deb12u1"}]}],"versions":["2.9.7-1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"apache-mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-1.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.9-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.9-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.9-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.9-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.9-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.11-1.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.6-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_security-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.6-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_security-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.6-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_security-mlogc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.6-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_security-mlogc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.6-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.6-1.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_security-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.6-1.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_security-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.6-1.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_security-mlogc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.6-1.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_security-mlogc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.6-1.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-12.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"mod_security-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-12.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"mod_security-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-12.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"mod_security-mlogc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-12.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"mod_security-mlogc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-12.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.6-1.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_security-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.6-1.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_security-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.6-1.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_security-mlogc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.6-1.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_security-mlogc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.6-1.el9_2.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.6-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-150400.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-150400.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-150400.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-150400.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-150400.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-150400.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-150400.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-150400.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-150400.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-150400.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-150400.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-150400.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-150400.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.2-150000.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.2-150000.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.2-150000.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.2-150000.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.0-7.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.0-7.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.7-2ubuntu0.1~esm2"}]}],"versions":["2.7.4-1","2.7.5-1","2.7.7-1","2.7.7-1ubuntu1","2.7.7-2","2.7.7-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-1ubuntu0.1~esm2"}]}],"versions":["2.9.0-1","2.9.0-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.2-1ubuntu0.1~esm2"}]}],"versions":["2.9.1-3","2.9.2-1","2.9.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-1ubuntu0.1+esm1"}]}],"versions":["2.9.3-1","2.9.3-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.5-1ubuntu0.1~esm2"}]}],"versions":["2.9.3-3","2.9.5-1","2.9.5-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-1ubuntu0.24.04.1~esm1"}]}],"versions":["2.9.7-1","2.9.7-1build2","2.9.7-1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.8-1.1","2.9.9-1","2.9.9-1ubuntu1","2.9.12-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.7-2ubuntu0.1~esm2"}]}],"versions":["2.7.4-1","2.7.5-1","2.7.7-1","2.7.7-1ubuntu1","2.7.7-2","2.7.7-2ubuntu0.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-1ubuntu0.1~esm2"}]}],"versions":["2.9.0-1","2.9.0-1ubuntu0.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.2-1ubuntu0.1~esm2"}]}],"versions":["2.9.1-3","2.9.2-1","2.9.2-1ubuntu0.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-1ubuntu0.1+esm1"}]}],"versions":["2.9.3-1","2.9.3-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.5-1ubuntu0.1~esm2"}]}],"versions":["2.9.3-3","2.9.5-1","2.9.5-1ubuntu0.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"modsecurity-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-1ubuntu0.24.04.1~esm1"}]}],"versions":["2.9.7-1","2.9.7-1build2","2.9.7-1build3"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache2-mod_security2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10-1.1"}]}],"bundled":2}],"products":[{"vendor":"owasp","product":"modsecurity"},{"vendor":"owasp-modsecurity","product":"modsecurity"}],"references":[{"url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-f82j-8pp7-cw2w","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-859r-vvv8-rm8r","tags":["x_refsource_MISC","Not Applicable","web","advisory","article","report"]},{"url":"https://github.com/owasp-modsecurity/ModSecurity/commit/3a54ccea62d3f7151bb08cb78d60c5e90b53ca2e","tags":["x_refsource_MISC","Patch","fix","article","report"]},{"url":"https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v2.x)#sanitisearg","tags":["x_refsource_MISC","Product","web","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/06/msg00009.html","tags":["Mailing List","discussion","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48866","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48866.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-48866","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0192.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34362","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2025/msg00104.html","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-7567-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1676","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1750","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52891","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:12838","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2369827","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_12838.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-48866","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48866","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2025:13670","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_13670.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:13716","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_13716.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:13775","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_13775.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:12838","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502028-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243976","tags":["report"]},{"url":"https://bugzilla.suse.com/1243978","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48866","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502029-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502052-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-48866","tags":["report"]},{"url":"https://github.com/owasp-modsecurity/ModSecurity/commit/fdfc2d5b21610651b0cefceb397be2cfc7aac8bb","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-47947","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-48866","title":"ModSecurity has possible DoS vulnerability in sanitiseArg action","description":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the  `sanitiseArg` (or `sanitizeArg`) action.","status":"published","published":"2025-06-02T15:46:19.909Z","modified":"2025-06-09T15:03:29.894Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-1050"],"updated_at":"2026-11-02T14:32:41.41198Z"}],"euvd":[{"id":"EUVD-2025-16670","description":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the  `sanitiseArg` (or `sanitizeArg`) action.","status":"published","published":"2025-06-02T15:46:19Z","modified":"2025-06-09T15:03:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:27.753525Z"}],"nvd":[{"id":"CVE-2025-48866","description":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the  `sanitiseArg` (or `sanitizeArg`) action.","status":"published","published":"2025-06-02T16:15:29.9Z","modified":"2026-06-17T09:30:24.437Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1050"],"updated_at":"2026-11-02T14:11:10.143444Z"}],"osv":[{"id":"CVE-2025-48866","title":"ModSecurity has possible DoS vulnerability in sanitiseArg action","description":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the  `sanitiseArg` (or `sanitizeArg`) action.","status":"published","published":"2025-06-02T15:46:19.909Z","modified":"2026-10-28T02:30:22.598420425Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1050"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"DEBIAN-CVE-2025-48866","description":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the  `sanitiseArg` (or `sanitizeArg`) action.","status":"published","published":"2025-06-02T16:15:29.9Z","modified":"2026-09-01T20:05:53.180655703Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"OESA-2025-1676","title":"mod_security security update","description":"Security Fix(es):\n\nModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the  `sanitiseArg` (or `sanitizeArg`) action.(CVE-2025-48866)","status":"published","published":"2025-06-27T11:08:46Z","modified":"2026-08-18T01:18:01.335019698Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1750","title":"mod_security security update","description":"Security Fix(es):\n\nA vulnerability was found in OWASP ModSecurity up to 2.9.9. It has been declared as critical.The manipulation of the argument sanitiseArg/sanitizeArg with an unknown input leads to a unknown weakness. The CWE definition for the vulnerability is CWE-1050. The product has a loop body or loop condition that contains a control element that directly or\n\t\t\t\t\tindirectly consumes platform resources, e.g. messaging, sessions, locks, or file\n\t\t\t\t\tdescriptors.As an impact it is known to affect availability.Upgrading to version 2.9.10 eliminates this vulnerability.(CVE-2025-48866)\n\nA vulnerability was found in OWASP ModSecurity 2.9.8/2.9.10 and classified as critical.Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Impacted is availability.Upgrading to version 2.9.11 eliminates this vulnerability.(CVE-2025-52891)","status":"published","published":"2025-07-11T11:08:50Z","modified":"2026-08-18T01:18:52.683184914Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"RHSA-2025:12838","title":"Red Hat Security Advisory: mod_security security update","status":"published","published":"2025-08-05T10:22:17Z","modified":"2026-07-12T10:03:34Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:13670","title":"Red Hat Security Advisory: mod_security security update","status":"published","published":"2025-08-12T10:03:41Z","modified":"2026-07-12T10:03:37Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:13716","title":"Red Hat Security Advisory: mod_security security update","status":"published","published":"2025-08-13T10:04:49Z","modified":"2026-07-12T10:03:38Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:13775","title":"Red Hat Security Advisory: mod_security security update","status":"published","published":"2025-08-13T10:04:49Z","modified":"2026-07-12T10:03:38Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RLSA-2025:12838","title":"Moderate: mod_security security update","description":"ModSecurity is an open source intrusion detection and prevention engine for web applications.\n\nSecurity Fix(es):\n\n* mod_security: ModSecurity Denial of Service Vulnerability (CVE-2025-48866)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-07T17:40:12.659778Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2025-48866","description":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the `sanitiseArg` (or `sanitizeArg`) action.","status":"published","published":"2025-06-02T16:15:00Z","modified":"2026-02-04T03:51:23.820988Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"AZL-62229","title":"CVE-2025-48866 affecting package mod_security 2.9.4-1","description":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the  `sanitiseArg` (or `sanitizeArg`) action.","status":"published","published":"2025-06-02T16:15:29Z","modified":"2026-04-21T04:31:57.794189Z","updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"AZL-62231","title":"CVE-2025-48866 affecting package mod_security 2.9.7-8","description":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the  `sanitiseArg` (or `sanitizeArg`) action.","status":"published","published":"2025-06-02T16:15:29Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"BIT-modsecurity-2025-48866","title":"ModSecurity has possible DoS vulnerability in sanitiseArg action","description":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the  `sanitiseArg` (or `sanitizeArg`) action.","status":"published","published":"2025-06-04T14:47:59.719Z","modified":"2026-09-08T08:46:34.753522037Z","updated_at":"2026-11-02T15:28:33.072289Z"},{"id":"BIT-modsecurity2-2025-48866","title":"ModSecurity has possible DoS vulnerability in sanitiseArg action","description":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the  `sanitiseArg` (or `sanitizeArg`) action.","status":"published","published":"2025-06-04T14:48:01.89Z","modified":"2026-09-08T08:48:13.92449118Z","updated_at":"2026-11-02T15:28:33.072289Z"},{"id":"DLA-4212-1","title":"modsecurity-apache - security update","status":"published","published":"2025-06-09T00:00:00Z","modified":"2026-03-09T01:22:25.049622Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5940-1","title":"modsecurity-apache - security update","status":"published","published":"2025-06-08T00:00:00Z","modified":"2026-03-09T02:10:22.608895Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0192","title":"Updated apache-mod_security packages fix security vulnerabilities","description":"ModSecurity Has Possible DoS Vulnerability. (CVE-2025-47947)\nModSecurity has possible DoS vulnerability in sanitiseArg action.\n(CVE-2025-48866)\n","status":"published","published":"2025-06-25T05:31:45Z","modified":"2026-04-16T04:44:33.04743655Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15197-1","title":"apache2-mod_security2-2.9.10-1.1 on GA media","description":"These are all security issues fixed in the apache2-mod_security2-2.9.10-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-06-03T00:00:00Z","modified":"2026-03-23T04:53:28.904214Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:02028-1","title":"Security update for apache2-mod_security2","description":"This update for apache2-mod_security2 fixes the following issues:\n\n- CVE-2025-47947: Fixed denial of service through sanitiseMatchedBytes (bsc#1243978).\n- CVE-2025-48866: Fixed denial of service via excessive number of arguments in sanitiseArg (bsc#1243976).\n","status":"published","published":"2025-06-19T15:16:46Z","modified":"2026-02-04T03:23:27.348017Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02029-1","title":"Security update for apache2-mod_security2","description":"This update for apache2-mod_security2 fixes the following issues:\n\n- CVE-2025-47947: Fixed denial of service through sanitiseMatchedBytes (bsc#1243978).\n- CVE-2025-48866: Fixed denial of service via excessive number of arguments in sanitiseArg (bsc#1243976).\n","status":"published","published":"2025-06-19T15:17:27Z","modified":"2025-06-20T12:59:21.60219Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02052-1","title":"Security update for apache2-mod_security2","description":"This update for apache2-mod_security2 fixes the following issues:\n\n- CVE-2025-47947: Fixed denial of service through sanitiseMatchedBytes (bsc#1243978).\n- CVE-2025-48866: Fixed denial of service via excessive number of arguments in sanitiseArg (bsc#1243976).\n","status":"published","published":"2025-06-20T13:04:57Z","modified":"2026-02-04T03:07:30.212216Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"USN-7567-1","title":"modsecurity-apache vulnerabilities","description":"Simon Studer discovered that ModSecurity incorrectly handled certain\nJSON objects. An attacker could possibly use this issue to cause a denial\nof service. (CVE-2025-47947)\n\nIt was discovered that ModSecurity incorrectly handled requests when\nparsing certain form data. An attacker could possibly use this issue to\ncause a denial of service. (CVE-2025-48866)","status":"published","published":"2025-06-13T05:00:45Z","modified":"2026-06-25T13:32:30.424294377Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}