ModSecurity has possible DoS vulnerability in sanitiseArg action
Published Jun 2, 2025
7.5
HIGHCVSS 3.1
EPSS 0.83%
Description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the `sanitiseArg` (or `sanitizeArg`) action.
Affected products
-
Affected
- < 2.9.10
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Owasp-Modsecurity | ModSecurity | unknown | Affected
|
- < 2.9.10
No data.
Red Hat Enterprise Linux 9
mod_security-0:2.9.6-2.el9_6.1
Fixed · RHSA-2025:12838
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
mod_security-0:2.9.3-12.el9_0.2
Fixed · RHSA-2025:13716
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
mod_security-0:2.9.6-1.el9_2.2
Fixed · RHSA-2025:13775
Red Hat Enterprise Linux 9.4 Extended Update Support
mod_security-0:2.9.6-1.el9_4.2
Fixed · RHSA-2025:13670
Red Hat Enterprise Linux 7
mod_security
Fix deferred
Red Hat Enterprise Linux 8
mod_security
Fix deferred
Red Hat JBoss Core Services
mod_security
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 9 | mod_security-0:2.9.6-2.el9_6.1 | Fixed | RHSA-2025:12838 |
| Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | mod_security-0:2.9.3-12.el9_0.2 | Fixed | RHSA-2025:13716 |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | mod_security-0:2.9.6-1.el9_2.2 | Fixed | RHSA-2025:13775 |
| Red Hat Enterprise Linux 9.4 Extended Update Support | mod_security-0:2.9.6-1.el9_4.2 | Fixed | RHSA-2025:13670 |
| Red Hat Enterprise Linux 7 | mod_security | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | mod_security | Fix deferred | n/a |
| Red Hat JBoss Core Services | mod_security | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
User configuration must have at least one rule that does a `sanitiseMatchedBytes` action to be affected. Default configurations are not affected.
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
References (10)
- https://access.redhat.com/security/cve/CVE-2025-48866 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2369827 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-16670 Advisory
- https://github.com/owasp-modsecurity/ModSecurity/commit/3a54ccea62d3f7151bb08cb78d60c5e90b53ca2e x_refsource_MISCPatch
- https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-859r-vvv8-rm8r x_refsource_MISCNot Applicable
- https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-f82j-8pp7-cw2w x_refsource_CONFIRMExploitVendor Advisory
- https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v2.x)#sanitisearg x_refsource_MISCProduct
- https://lists.debian.org/debian-lts-announce/2025/06/msg00009.html Mailing List
- https://nvd.nist.gov/vuln/detail/CVE-2025-48866
- https://www.cve.org/CVERecord?id=CVE-2025-48866
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2025-48866 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2369827 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-16670 | Advisory | |
| https://github.com/owasp-modsecurity/ModSecurity/commit/3a54ccea62d3f7151bb08cb78d60c5e90b53ca2e | x_refsource_MISCPatch | |
| https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-859r-vvv8-rm8r | x_refsource_MISCNot Applicable | |
| https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-f82j-8pp7-cw2w | x_refsource_CONFIRMExploitVendor Advisory | |
| https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v2.x)#sanitisearg | x_refsource_MISCProduct | |
| https://lists.debian.org/debian-lts-announce/2025/06/msg00009.html | Mailing List | |
| https://nvd.nist.gov/vuln/detail/CVE-2025-48866 | ||
| https://www.cve.org/CVERecord?id=CVE-2025-48866 |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
GitHub
No data