CVE-2025-48866 Details
Description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the `sanitiseArg` (or `sanitizeArg`) action.
A denial-of-service vulnerability has been identified in ModSecurity versions prior to 2.9.10. The issue arises in the `sanitiseArg` action, which can be exploited by sending a large number of arguments, leading to excessive memory consumption. This vulnerability is particularly problematic when the request payload is `application/json`, as the JSON processor can generate a high volume of arguments that are then repeatedly added to a list for sanitization. After a few such requests, the server may run out of memory, causing an error.
Users can upgrade to ModSecurity version 2.9.10 or later, where this vulnerability has been patched. If an upgrade is not possible, avoid using rules that include the `sanitiseArg` action.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 2, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1050 | Excessive Platform Resource Consumption within a Loop | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| owasp modsecurity | < 2.9.10 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 2, 2025 | Initial Analysis | [email protected] |
| Jun 9, 2025 | CVE Modified | CVE |
| Jun 2, 2025 | New CVE Received | [email protected] |