CVE catalog

CVE-2025-54571

modsecurity-apache: CVE-2025-54571

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.31% · Oct 25, 2026

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmodsecurity-apachesid2.9.13-1fixed
Debianmodsecurity-apacheforky2.9.13-1fixed
Debianmodsecurity-apachetrixie2.9.11-1+deb13u1fixed
Debianmodsecurity-apachebookworm2.9.7-1+deb12u2fixed
Debianmodsecurity-apachebookworm-security2.9.7-1+deb12u1vulnerable
Opensuseapache2-mod_security2tumbleweed2.9.12-1.1fixed
Suseapache2-mod_security2linux enterprise server ltss extended security 12 sp52.8.0-7.12.1fixed
Suseapache2-mod_security2linux enterprise module for server applications 15 sp62.9.4-150400.3.12.1fixed
Suseapache2-mod_security2linux enterprise module for server applications 15 sp72.9.4-150400.3.12.1fixed
Opensuseapache2-mod_security2leap 15.62.9.4-150400.3.12.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmodsecurity-apachesourcesid2.9.12-2not yet assignedNot reported[1110480]
Debianmodsecurity-apachesourceforky2.9.12-2not yet assignedNot reported[1110480]
Debianmodsecurity-apachesourcetrixie2.9.11-1+deb13u1not yet assignedNot reported[1110480]
Debianmodsecurity-apachesourcebookworm2.9.7-1+deb12u2not yet assignedNot reported[1110480]
Opensuseapache2-mod_security2rpmtumbleweed2.9.12-1.1Not reportedOPENSUSE-SU-2025:15456-1Not reported
Suseapache2-mod_security2rpmlinux enterprise server ltss extended security 12 sp52.8.0-7.12.1Not reportedSUSE-SU-2025:03423-1Not reported
Suseapache2-mod_security2rpmlinux enterprise module for server applications 15 sp62.9.4-150400.3.12.1Not reportedSUSE-SU-2025:03422-1Not reported
Suseapache2-mod_security2rpmlinux enterprise module for server applications 15 sp72.9.4-150400.3.12.1Not reportedSUSE-SU-2025:03422-1Not reported
Opensuseapache2-mod_security2rpmleap 15.62.9.4-150400.3.12.1Not reportedSUSE-SU-2025:03422-1Not reported

[Debian bug #1110480]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libapache2-mod-security2]Affected

    Source package: [modsecurity-apache]

    Details (4)

    • 2.9.7-1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.9.7-1+deb12u2

      dsa · modsecurity-apache · debian · bookworm; dsa · modsecurity-apache · debian · 12

    • 2.9.7-1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.9.7-1+deb12u2

      dsa · modsecurity-apache · debian · bookworm; dsa · modsecurity-apache · debian · 12

    • 2.9.7-1+deb12u1 · amd64 · bookworm-security

      Affected · Fixed: 2.9.7-1+deb12u2

      dsa · modsecurity-apache · debian · bookworm; dsa · modsecurity-apache · debian · 12

    • 2.9.7-1+deb12u1 · arm64 · bookworm-security

      Affected · Fixed: 2.9.7-1+deb12u2

      dsa · modsecurity-apache · debian · bookworm; dsa · modsecurity-apache · debian · 12

[Debian 13 (Trixie)]

  • [libapache2-mod-security2]Fixed

    Source package: [modsecurity-apache]

    Details (2)

    • 2.9.11-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.9.11-1+deb13u1

      dsa · modsecurity-apache · debian · 13

    • 2.9.11-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.9.11-1+deb13u1

      dsa · modsecurity-apache · debian · 13

[openSUSE Tumbleweed]

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]