Homepage

Excessive Platform Resource Consumption within a Loop The advisory has been revoked - it doesn't affect any version of package mod_security  (opens in a new tab)

Threat Intelligence

EPSS
0.83% (56th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-MODSECURITY-13175608
  • published1 Oct 2025
  • disclosed2 Jun 2025
Report a new vulnerability Found a mistake?

Introduced: 2 Jun 2025

CVE-2025-48866  (opens in a new tab)
CWE-1050  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream mod_security package and not the mod_security package as distributed by RHEL.

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg (and sanitizeArg - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the sanitiseArg (or sanitizeArg) action.