Denial of Service Vulnerability in ModSecurity by OWASP
CVE-2025-47947

7.5HIGH

Key Information:

Vendor

Owasp-modsecurity

Status
Modsecurity
Vendor
CVE Published:
21 May 2025

What is CVE-2025-47947?

ModSecurity, an open source web application firewall engine utilized with Apache, IIS, and Nginx, presents a vulnerability that can lead to a denial of service condition under specific circumstances. This occurs in versions up to and including 2.9.8 when processing requests with the content type application/json in conjunction with rules that execute the sanitiseMatchedBytes action. A patch has been proposed in pull request 3389 and is anticipated to be included in the upcoming version 2.9.9. Currently, no workarounds are available for this vulnerability.

Affected Version(s)

ModSecurity <= 2.9.8

References

https://github.com/owasp-modsecurity/ModSecurity/security...
x_refsource_CONFIRM
https://github.com/owasp-modsecurity/ModSecurity/pull/3389
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.