modsecurity-apache vulnerabilities (Debian)

16 vulnerabilities.

• modsecurity-apache Debian [GHSA-5pww-8rfg-9crf: RFC 2231 filename* parameter bypasses multipart filename rules] CVE-2026-104269 No scoreOctober 5, 2026
• modsecurity-apache Debian [GHSA-qrch-pjfr-9g47: t:removeComments mishandles the character after a comment terminator, bypassing rules] CVE-2026-104259 No scoreOctober 5, 2026
• modsecurity-apache Debian [GHSA-2vqc-36qp-ccmw: Weak libcurl TLS hostname verification setting when fetching over HTTPS] CVE-2026-61813 No scoreOctober 1, 2026
• modsecurity-apache Debian [GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to evasion] CVE-2026-61812 No scoreOctober 1, 2026
• modsecurity-apache Debian ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure CVE-2025-54571 Fix available 6.9 MediumAugust 5, 2025
• modsecurity-apache Debian ModSecurity empty XML tag causes segmentation fault CVE-2025-52891 Fix available 6.5 MediumJuly 2, 2025
• modsecurity-apache Debian ModSecurity has possible DoS vulnerability in sanitiseArg action CVE-2025-48866 Fix available 7.5 HighJune 2, 2025
• modsecurity-apache Debian ModSecurity Has Possible DoS Vulnerability CVE-2025-47947 Public exploitFix available 7.5 HighMay 21, 2025
• modsecurity-apache Debian In ModSecurity before 2.9.7, FILES_TMP_CONTENT sometimes lacked the complete content. This can... CVE-2023-24021 Fix available 7.5 HighJanuary 20, 2023
• modsecurity-apache Debian In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed... CVE-2022-48279 Fix available 7.5 HighJanuary 20, 2023
• modsecurity-apache Debian ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects... CVE-2021-42717 Public exploitFix available 7.5 HighDecember 7, 2021
• modsecurity-apache Debian apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by... CVE-2013-5705 Fix available 5.0 MediumApril 15, 2014
• modsecurity-apache Debian The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a... CVE-2013-2765 Public exploitFix available EPSS 13.7% 5.0 MediumJune 26, 2013
• modsecurity-apache Debian ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to... CVE-2013-1915 Fix available 7.5 HighApril 9, 2013
• modsecurity-apache Debian The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to... CVE-2012-4528 Public exploitFix available EPSS 12.4% 5.0 MediumDecember 28, 2012
• modsecurity-apache Debian ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the... CVE-2012-2751 Fix available 4.3 MediumJuly 2, 2012