CVE-2025-52891CWE-20

ModSecurity empty XML tag causes segmentation fault

Medium · published July 2, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
31.0
In the wild
Unconfirmed
What it is

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00382 · 31.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-07-02T15:03Z
EPSS history
Timeline
  • 02 JUL 15:03Z
    ModSecurity empty XML tag causes segmentation fault
    cvelistv5