← Vulnerability feed

Vulnerability record · CVE-2025-47947 · published 21 May 2025

CVE-2025-47947: Trustwave modsecurity vulnerability

Trustwave · Modsecurity

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.

7.5 CVSS 3.1 High EPSS 0.60% · top 53.6% CWE-1050 · CWE-1050
7.5CVSS 3.1 base score
0.60%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/owasp-modsecurity/ModSecurity/pull/3389 Issue TrackingPatch
https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-859r-vvv8-rm8r ExploitVendor Advisory
https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-859r-vvv8-rm8r ExploitVendor Advisory

Track CVE-2025-47947 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.9CVE-2025-27110Trustwave modsecurity vulnerabilityLibmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web tr…EPSS 0.49%7.5CVE-2024-46292Trustwave modsecurity classic buffer overflow vulnerabilityA buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name parameter. NO…EPSS 0.82%7.5CVE-2023-24021Trustwave modsecurity vulnerabilityIncorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on…EPSS 0.91%7.5CVE-2022-48279Owasp modsecurity interpretation conflict vulnerabilityIn ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE…EPSS 1.2%7.5CVE-2021-42717Owasp modsecurity vulnerabilityModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in th…EPSS 3.1%7.5CVE-2013-1915Trustwave modsecurity xml external entity (xxe) vulnerabilityModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU a…EPSS 4.2%5.0CVE-2013-5705Trustwave modsecurity vulnerabilityapache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked…EPSS 2.7%5.0CVE-2013-2765Trustwave modsecurity null pointer dereference vulnerabilityThe ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, proces…EPSS 14%

Source: NIST National Vulnerability Database (record CVE-2025-47947), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.