CVE catalog

CVE-2025-47947

ModSecurity vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.60% · Oct 25, 2026

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmodsecurity-apachesid2.9.13-1fixed
Debianmodsecurity-apacheforky2.9.13-1fixed
Debianmodsecurity-apachetrixie2.9.11-1+deb13u1fixed
Debianmodsecurity-apachebookworm2.9.7-1+deb12u2fixed
Debianmodsecurity-apachebookworm-security2.9.7-1+deb12u1fixed
Ubuntumodsecurity-apachenoble2.9.7-1ubuntu0.24.04.1~esm1fixed
Ubuntulibapache2-mod-security2noble2.9.7-1ubuntu0.24.04.1~esm1fixed
Ubuntumodsecurity-apachepro2.9.7-1vulnerable
Ubuntumodsecurity-apachepro2.9.7-1build2vulnerable
Ubuntumodsecurity-apachepro2.9.7-1build3vulnerable
Ubuntumodsecurity-apachepro2.9.7-1ubuntu0.24.04.1~esm1fixed
Opensuseapache2-mod_security2tumbleweed2.9.10-1.1fixed
Suseapache2-mod_security2linux enterprise module for server applications 15 sp62.9.4-150400.3.9.1fixed
Suseapache2-mod_security2linux enterprise module for server applications 15 sp72.9.4-150400.3.9.1fixed
Suseapache2-mod_security2linux enterprise high performance computing 15 sp4-espos2.9.4-150400.3.9.1fixed
Suseapache2-mod_security2linux enterprise high performance computing 15 sp4-ltss2.9.4-150400.3.9.1fixed
Suseapache2-mod_security2linux enterprise high performance computing 15 sp5-espos2.9.4-150400.3.9.1fixed
Suseapache2-mod_security2linux enterprise high performance computing 15 sp5-ltss2.9.4-150400.3.9.1fixed
Suseapache2-mod_security2linux enterprise server 15 sp4-ltss2.9.4-150400.3.9.1fixed
Suseapache2-mod_security2linux enterprise server 15 sp5-ltss2.9.4-150400.3.9.1fixed
Suseapache2-mod_security2linux enterprise server for sap applications 15 sp42.9.4-150400.3.9.1fixed
Suseapache2-mod_security2linux enterprise server for sap applications 15 sp52.9.4-150400.3.9.1fixed
Suseapache2-mod_security2manager proxy 4.32.9.4-150400.3.9.1fixed
Suseapache2-mod_security2manager server 4.32.9.4-150400.3.9.1fixed
Opensuseapache2-mod_security2leap 15.62.9.4-150400.3.9.1fixed
Ubuntumodsecurity-apachepro2.9.7-1vulnerable
Ubuntumodsecurity-apachepro2.9.7-1build2vulnerable
Ubuntumodsecurity-apachepro2.9.7-1build3vulnerable
Ubuntumodsecurity-apachepro2.9.7-1ubuntu0.24.04.1~esm1fixed
Suseapache2-mod_security2linux enterprise server 12 sp5-ltss2.8.0-7.9.1fixed
Suseapache2-mod_security2linux enterprise server ltss extended security 12 sp52.8.0-7.9.1fixed
Suseapache2-mod_security2linux enterprise high performance computing 15 sp3-ltss2.9.2-150000.3.12.1fixed
Suseapache2-mod_security2linux enterprise server 15 sp3-ltss2.9.2-150000.3.12.1fixed
Suseapache2-mod_security2linux enterprise server for sap applications 15 sp32.9.2-150000.3.12.1fixed
Suseapache2-mod_security2enterprise storage 7.12.9.2-150000.3.12.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmodsecurity-apachesourcesid2.9.9-1not yet assignedNot reported[1106286]
Debianmodsecurity-apachesourceforky2.9.9-1not yet assignedNot reported[1106286]
Debianmodsecurity-apachesourcetrixie2.9.9-1not yet assignedNot reported[1106286]
Debianmodsecurity-apachesourcebookworm2.9.7-1+deb12u1not yet assignedNot reported[1106286]
Ubuntumodsecurity-apachedebnoble2.9.7-1ubuntu0.24.04.1~esm1Not reportedNot reportedNot reported
Ubuntulibapache2-mod-security2debnoble2.9.7-1ubuntu0.24.04.1~esm1Not reportedNot reportedNot reported
Ubuntumodsecurity-apachedebpro2.9.7-1ubuntu0.24.04.1~esm1Not reportedUSN-7567-1Not reported
Opensuseapache2-mod_security2rpmtumbleweed2.9.10-1.1Not reportedOPENSUSE-SU-2025:15197-1Not reported
Suseapache2-mod_security2rpmlinux enterprise module for server applications 15 sp62.9.4-150400.3.9.1Not reportedSUSE-SU-2025:02028-1Not reported
Suseapache2-mod_security2rpmlinux enterprise module for server applications 15 sp72.9.4-150400.3.9.1Not reportedSUSE-SU-2025:02028-1Not reported
Suseapache2-mod_security2rpmlinux enterprise high performance computing 15 sp4-espos2.9.4-150400.3.9.1Not reportedSUSE-SU-2025:02028-1Not reported
Suseapache2-mod_security2rpmlinux enterprise high performance computing 15 sp4-ltss2.9.4-150400.3.9.1Not reportedSUSE-SU-2025:02028-1Not reported
Suseapache2-mod_security2rpmlinux enterprise high performance computing 15 sp5-espos2.9.4-150400.3.9.1Not reportedSUSE-SU-2025:02028-1Not reported
Suseapache2-mod_security2rpmlinux enterprise high performance computing 15 sp5-ltss2.9.4-150400.3.9.1Not reportedSUSE-SU-2025:02028-1Not reported
Suseapache2-mod_security2rpmlinux enterprise server 15 sp4-ltss2.9.4-150400.3.9.1Not reportedSUSE-SU-2025:02028-1Not reported
Suseapache2-mod_security2rpmlinux enterprise server 15 sp5-ltss2.9.4-150400.3.9.1Not reportedSUSE-SU-2025:02028-1Not reported
Suseapache2-mod_security2rpmlinux enterprise server for sap applications 15 sp42.9.4-150400.3.9.1Not reportedSUSE-SU-2025:02028-1Not reported
Suseapache2-mod_security2rpmlinux enterprise server for sap applications 15 sp52.9.4-150400.3.9.1Not reportedSUSE-SU-2025:02028-1Not reported
Suseapache2-mod_security2rpmmanager proxy 4.32.9.4-150400.3.9.1Not reportedSUSE-SU-2025:02028-1Not reported
Suseapache2-mod_security2rpmmanager server 4.32.9.4-150400.3.9.1Not reportedSUSE-SU-2025:02028-1Not reported
Opensuseapache2-mod_security2rpmleap 15.62.9.4-150400.3.9.1Not reportedSUSE-SU-2025:02028-1Not reported
Ubuntumodsecurity-apachedebpro2.9.7-1ubuntu0.24.04.1~esm1Not reportedUBUNTU-CVE-2025-47947Not reported
Suseapache2-mod_security2rpmlinux enterprise server 12 sp5-ltss2.8.0-7.9.1Not reportedSUSE-SU-2025:02052-1Not reported
Suseapache2-mod_security2rpmlinux enterprise server ltss extended security 12 sp52.8.0-7.9.1Not reportedSUSE-SU-2025:02052-1Not reported
Suseapache2-mod_security2rpmlinux enterprise high performance computing 15 sp3-ltss2.9.2-150000.3.12.1Not reportedSUSE-SU-2025:02029-1Not reported
Suseapache2-mod_security2rpmlinux enterprise server 15 sp3-ltss2.9.2-150000.3.12.1Not reportedSUSE-SU-2025:02029-1Not reported
Suseapache2-mod_security2rpmlinux enterprise server for sap applications 15 sp32.9.2-150000.3.12.1Not reportedSUSE-SU-2025:02029-1Not reported
Suseapache2-mod_security2rpmenterprise storage 7.12.9.2-150000.3.12.1Not reportedSUSE-SU-2025:02029-1Not reported

[Debian bug #1106286]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libapache2-mod-security2]Fixed

    Source package: [modsecurity-apache]

    Details (4)

    • 2.9.7-1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.9.7-1+deb12u1

      usn · modsecurity-apache · debian · bookworm; usn · modsecurity-apache · debian · 12

    • 2.9.7-1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.9.7-1+deb12u1

      usn · modsecurity-apache · debian · bookworm; usn · modsecurity-apache · debian · 12

    • 2.9.7-1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.7-1+deb12u1

      usn · modsecurity-apache · debian · bookworm; usn · modsecurity-apache · debian · 12

    • 2.9.7-1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.7-1+deb12u1

      usn · modsecurity-apache · debian · bookworm; usn · modsecurity-apache · debian · 12

[Debian 13 (Trixie)]

  • [libapache2-mod-security2]Fixed

    Source package: [modsecurity-apache]

    Details (2)

    • 2.9.11-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.9.9-1

      usn · modsecurity-apache · debian · 13

    • 2.9.11-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.9.9-1

      usn · modsecurity-apache · debian · 13

[openSUSE Tumbleweed]

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]