The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Modsecurity | Trustwave | * | 2.7.4 (excluding) |
| Modsecurity-apache | Ubuntu | precise | * |
| Modsecurity-apache | Ubuntu | upstream | * |