Advisories · Technology
ModSecurity.
Every CVE that names ModSecurity among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.6 High
ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)
- ModSecurity
- CWE-436
- CVSS 8.6 High
ModSecurity: Response Body Inspection Bypass
- ModSecurity
- CWE-178
- CVSS 3.7 Low
ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download
- ModSecurity
- Weak cryptography or TLS
- CVSS 5.8 Medium
ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match
- ModSecurity
- CWE-253
- CVSS 8.6 High
ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass
- ModSecurity
- CWE-180
- CVSS 5.8 Medium
ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture
- ModSecurity
- CWE-467
- CVSS 8.2 High
ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators
- ModSecurity
- Memory corruption
- CWE-248
- CVSS 8.2 High
libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings
- ModSecurity
- Memory corruption
- CVSS 6.9 Medium
ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure
- ModSecurity
- CWE-252
- CVSS 6.5 Medium
ModSecurity empty XML tag causes segmentation fault
- ModSecurity
- CWE-20
- CVSS 7.5 High
ModSecurity has possible DoS vulnerability in sanitiseArg action
- ModSecurity
- CWE-1050
- CVSS 7.5 High
ModSecurity Has Possible DoS Vulnerability
- ModSecurity
- CWE-1050
- CVSS 7.9 High
Libmodsecurity3 has possible bypass of encoded HTML entities
- ModSecurity
- CWE-172
- CVSS 8.6 High
WAF bypass of the ModSecurity v3 release line
- ModSecurity
- CWE-20