Modsecurity
Approved changes feed: RSS · Atom
cpe:2.3:a:trustwave:modsecurity:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Trustwave (6c155704-d914-5827-813b-8323af3b9ac7) |
|---|---|
| Product | Modsecurity (dfa208ee-3580-512a-b01b-b0dff4c0bf03) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/spiderlabs/modsecurity |
purl2cpe | 2026-06-01 10:11:43.256498 |
pkg:rpm/opensuse/modsecurity |
purl2cpe | 2026-06-01 10:11:43.256500 |
pkg:sourceforge/mod-security |
purl2cpe | 2026-06-01 10:11:43.256502 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-47947 |
vulnerable | 2026-06-08 07:27:15.102140 |
ModSecurity Has Possible DoS Vulnerability
HIGH (7.5)
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.
Published: 2025-05-21T22:08:31.982Z
Updated: 2025-05-22T15:51:50.750Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1019 |
vulnerable | 2026-06-08 06:25:39.010461 |
WAF bypass of the ModSecurity v3 release line
HIGH (8.6)
ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component from the optional query string component. This results in an impedance mismatch versus RFC compliant back-end applications. The vulnerability hides an attack payload in the path component of the URL from WAF rules inspecting it. A back-end may be vulnerable if it uses the path component of request URLs to construct queries. Integrators and users are advised to upgrade to 3.0.12. The ModSecurity v2 release line is not affected by this vulnerability.
Published: 2024-01-30T16:09:42.428Z
Updated: 2025-06-17T21:29:18.248Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-38285 |
vulnerable | 2026-06-08 06:08:17.542817 |
Details available
Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity.
Published: 2023-07-26T00:00:00.000Z
Updated: 2024-10-23T15:42:14.669Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28882 |
vulnerable | 2026-06-08 06:02:36.588277 |
Details available
Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.
Published: 2023-04-28T00:00:00.000Z
Updated: 2025-01-30T20:42:27.303Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-24021 |
vulnerable | 2026-06-08 05:56:05.007124 |
Details available
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.
Published: 2023-01-20T00:00:00.000Z
Updated: 2025-04-02T16:18:27.850Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-48279 |
vulnerable | 2026-06-08 05:50:41.788020 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-42717 |
vulnerable | 2026-06-08 05:35:22.471610 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-15598 |
vulnerable | 2026-06-08 05:19:26.206246 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-25043 |
vulnerable | 2026-06-08 05:13:41.855552 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-19886 |
vulnerable | 2026-06-08 05:13:23.932250 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-5705 |
vulnerable | 2026-06-08 05:04:53.249057 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-2765 |
vulnerable | 2026-06-08 05:04:27.811968 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-1915 |
vulnerable | 2026-06-08 05:03:57.260980 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-4528 |
vulnerable | 2026-06-08 05:02:51.163529 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-2751 |
vulnerable | 2026-06-08 05:02:06.150592 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2009-5031 |
vulnerable | 2026-06-08 04:51:50.847621 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2009-1903 |
vulnerable | 2026-06-08 04:51:25.632069 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2009-1902 |
vulnerable | 2026-06-08 04:51:25.631478 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.