OWASP ModSecurity vulnerabilities
We track 10 vulnerabilities in OWASP ModSecurity products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on November 9, 2026.
Latest OWASP ModSecurity vulnerabilities
- 7.5 High severity
ModSecurity: Out-of-bounds Write
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsing_ctx_arg uninitialize
- 8.6 High severity
ModSecurity: Improper Handling of Case Sensitivity
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-
- 8.6 High severity
ModSecurity: Interpretation Conflict
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js
- 8.6 High severity
ModSecurity: Incorrect Behavior Order: Validate Before Canonicalize
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values
- 7.5 High severity
ModSecurity: Integer Underflow (Wrap or Wraparound)
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exception (std::out_of_range) caused by unsigned integer underflow in libmodsecurity3 if the user
- 7.5 High severity
ModSecurity: Out-of-bounds Read
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Libmodsecurity is one component of the ModSecurity v3 project. A segmentation fault occurs when a rule using the t:hexDecode transformation inspects
- 7.5 High severity
ModSecurity: Excessive Platform Resource Consumption within a Loop
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg
- 7.5 High severity
ModSecurity: Excessive Platform Resource Consumption within a Loop
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content
- 7.5 High severity
ModSecurity: Improper Encoding or Decoding of Data
Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13
- 8.6 High severity
ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based…
ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component