CVEFinder.io

CVE-2025-48866

⚠️ high
🔍 Scan for this CVE
Summary

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the `sanitiseArg` (or

Description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the `sanitiseArg` (or `sanitizeArg`) action.

CVSS Score
7.5
High
EPSS Score
0.3
Exploit Probability
Published Date
2025-06-02
First Seen: 2026-01-05
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 69.0% of all 326,604 vulnerabilities in our database.

#101,315
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jun 2, 2025
🔍 Exploitation Status
Poc
Proof-of-concept available
⚙️ Automatable
YES
Can be exploited automatically
💥 Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2025-07-02
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE IDs (Weakness Types)
CWE-1050

📦 Affected Products 1

Vendor Product Status Affected Versions
owasp modsecurity Affected
< 2.9.10

🔗 References 5

https://github.com/owasp-modsecurity/ModSecurity/com...
Patch
https://github.com/owasp-modsecurity/ModSecurity/sec...
Not Applicable
https://github.com/owasp-modsecurity/ModSecurity/sec...
Exploit Vendor Advisory
https://github.com/owasp-modsecurity/ModSecurity/wik...
Product
https://lists.debian.org/debian-lts-announce/2025/06...
Mailing List

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-42268 ⚠️ high 7.5 0.0 ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.... 2026-05-12
CVE-2026-30923 ⚠️ high 7.5 0.0 ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Libmodsec... 2026-05-05
CVE-2025-54571 🔶 medium 6.1 0.1 ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versio... 2025-08-06
CVE-2024-1019 ⚠️ high 8.6 0.3 ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially... 2024-01-30
CVE-2023-38285 ⚠️ high 7.5 0.5 Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity. 2023-07-26
CVE-2023-28882 ⚠️ high 7.5 0.1 Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) be... 2023-04-28
These CVEs affect the same products