CVE-2025-48866
HIGHDescription
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the `sanitiseArg` (or `sanitizeArg`) action.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| owasp | modsecurity |
References
Advisories & Patches
Frequently Asked Questions
What is CVE-2025-48866? +
How severe is CVE-2025-48866? +
What products are affected by CVE-2025-48866? +
How do I check if I'm vulnerable to CVE-2025-48866? +
Related Vulnerabilities
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to …
The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could …
A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This …
FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension …
An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component.
ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request …