CVE-2025-48866
ModSecurity has possible DoS vulnerability in sanitiseArg action
Summary
ModSecurity has possible DoS vulnerability in sanitiseArg action
Original description
The description as published by the source.
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg (and sanitizeArg - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the sanitiseArg (or sanitizeArg) action.
Affected packages
Bitnami
modsecurity
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.12"}]}]
Bitnami
modsecurity2
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.9.10"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-48866 modsecurity-apache Fixed in: 2.9.3-3+deb11u4
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com
- web github.com
- web lists.debian.org