CVE-2025-48866CWE-1050

ModSecurity has possible DoS vulnerability in sanitiseArg action

High · published June 2, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
57.1
In the wild
Unconfirmed
What it is

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the `sanitiseArg` (or `sanitizeArg`) action.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00831 · 57.1th percentile
Weakness
CWE-1050 · Excessive Platform Resource Consumption within a Loop
Published
2025-06-02T15:46Z
EPSS history
Timeline
  • 02 JUN 15:46Z
    ModSecurity has possible DoS vulnerability in sanitiseArg action
    cvelistv5