CVE-2025-48866highCWE-1050

CVE-2025-48866: high-severity vulnerability in owasp-modsecurity ModSecurity

ModSecurity has possible DoS vulnerability in sanitiseArg action

Published · Updated

Follow this CVE+ Monitor ModSecurity+ Monitor modsecurity-apache

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.9%
In short

ModSecurity versions before 2.9.10 have a denial of service vulnerability in the sanitiseArg action. An attacker can send requests with an excessive number of arguments to crash or freeze the WAF, disrupting web application protection.

Technical detail

The sanitiseArg action in ModSecurity prior to 2.9.10 is vulnerable to denial of service when processing requests containing an excessive number of arguments. An attacker can exploit this by crafting HTTP requests with many parameters, causing resource exhaustion and WAF unavailability without requiring authentication or special privileges.

Summary generated and translated by AI from the official description.
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the `sanitiseArg` (or `sanitizeArg`) action.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
owasp-modsecurity · ModSecurity
Related CVEs — owasp-modsecurity ModSecurity

In the same product, most dangerous first.

CVE-2025-47947HIGHModSecurity Has Possible DoS VulnerabilityEPSS 0.6%CVE-2026-104269HIGHModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)EPSS 0.6%CVE-2026-73856HIGHModSecurity: Response Body Inspection BypassEPSS 0.6%CVE-2025-27110HIGHLibmodsecurity3 has possible bypass of encoded HTML entitiesEPSS 0.5%CVE-2026-52747HIGHModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypassEPSS 0.5%CVE-2026-30923HIGHlibModSecurity3 denial of service via segfault when using t:hexDecode on single-character query stringsEPSS 0.4%