Segmentation Fault Vulnerability in ModSecurity Web Application Firewall by OWASP

CVE-2025-52891

What is CVE-2025-52891?

ModSecurity, an open source web application firewall engine used across Apache, IIS, and Nginx servers, is susceptible to a specific issue in XML processing. In versions 2.9.8 up to, but not including, 2.9.11, an empty XML tag in requests labeled as application/xml can trigger a segmentation fault. This occurs when the SecParseXmlIntoArgs option is enabled and at least one XML tag is empty (e.g., ). The problem has been resolved in ModSecurity version 2.9.11. Users are encouraged to upgrade to this version or implement a workaround by disabling SecParseXmlIntoArgs.

References