ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg (and sanitizeArg - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the sanitiseArg (or sanitizeArg) action.
The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Modsecurity-apache | Ubuntu | esm-apps/bionic | * |
| Modsecurity-apache | Ubuntu | esm-apps/focal | * |
| Modsecurity-apache | Ubuntu | esm-apps/jammy | * |
| Modsecurity-apache | Ubuntu | esm-apps/noble | * |
| Modsecurity-apache | Ubuntu | esm-apps/xenial | * |
| Modsecurity-apache | Ubuntu | esm-infra-legacy/trusty | * |
| Modsecurity-apache | Ubuntu | focal | * |
| Modsecurity-apache | Ubuntu | jammy | * |
| Modsecurity-apache | Ubuntu | noble | * |
| Modsecurity-apache | Ubuntu | oracular | * |
| Modsecurity-apache | Ubuntu | plucky | * |
| Modsecurity-apache | Ubuntu | upstream | * |
This issue can make the product perform more slowly. If an attacker can influence the number of iterations in the loop, then this performance problem might allow a denial of service by consuming more platform resources than intended.