CVE catalog
CVE-2019-19886
modsecurity: CVE-2019-19886
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 2.50% · Oct 25, 2026
Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming slow or unresponsive (Denial of Service) because of a flaw in Transaction::addRequestHeader in transaction.cc.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | modsecurity | sid | 3.0.16-1 | fixed |
| Debian | modsecurity | forky | 3.0.16-1 | fixed |
| Debian | modsecurity | trixie | 3.0.14-1+deb13u1 | fixed |
| Debian | modsecurity | bookworm | 3.0.9-1+deb12u2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | modsecurity | source | sid | 3.0.4-1 | not yet assigned | Not reported | [949682] |
| Debian | modsecurity | source | forky | 3.0.4-1 | not yet assigned | Not reported | [949682] |
| Debian | modsecurity | source | trixie | 3.0.4-1 | not yet assigned | Not reported | [949682] |
| Debian | modsecurity | source | bookworm | 3.0.4-1 | not yet assigned | Not reported | [949682] |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libmodsecurity3]Fixed
Source package: [modsecurity]
Details (2)
3.0.9-1+deb12u2· amd64 · bookwormFixed · Fixed:
3.0.4-1dsa · modsecurity · debian · bookworm; dsa · modsecurity · debian · 12
3.0.9-1+deb12u2· arm64 · bookwormFixed · Fixed:
3.0.4-1dsa · modsecurity · debian · bookworm; dsa · modsecurity · debian · 12
- [libmodsecurity-dev]Fixed
Source package: [modsecurity]
Details (2)
3.0.9-1+deb12u2· amd64 · bookwormFixed · Fixed:
3.0.4-1dsa · modsecurity · debian · bookworm; dsa · modsecurity · debian · 12
3.0.9-1+deb12u2· arm64 · bookwormFixed · Fixed:
3.0.4-1dsa · modsecurity · debian · bookworm; dsa · modsecurity · debian · 12
[Debian 13 (Trixie)]
- [libmodsecurity3t64]Fixed
Source package: [modsecurity]
Details (2)
3.0.14-1+deb13u1· amd64 · trixieFixed · Fixed:
3.0.4-1dsa · modsecurity · debian · 13
3.0.14-1+deb13u1· arm64 · trixieFixed · Fixed:
3.0.4-1dsa · modsecurity · debian · 13
- [libmodsecurity-dev]Fixed
Source package: [modsecurity]
Details (2)
3.0.14-1+deb13u1· amd64 · trixieFixed · Fixed:
3.0.4-1dsa · modsecurity · debian · 13
3.0.14-1+deb13u1· arm64 · trixieFixed · Fixed:
3.0.4-1dsa · modsecurity · debian · 13
Observed: