CVE-2019-19886

Name	CVE-2019-19886
Description	Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming slow or unresponsive (Denial of Service) because of a flaw in Transaction::addRequestHeader in transaction.cc.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	949682

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
modsecurity (PTS)	buster, buster (security)	3.0.3-1+deb10u2	fixed
	bullseye	3.0.4-2	fixed
	bookworm	3.0.9-1+deb12u1	fixed
	trixie	3.0.12-1	fixed
	sid	3.0.12-1.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
modsecurity	source	buster	3.0.3-1+deb10u1
modsecurity	source	(unstable)	3.0.4-1			949682

https://github.com/SpiderLabs/ModSecurity/pull/2202
https://github.com/SpiderLabs/ModSecurity/commit/7ba77631f9a37e0680d23ee57c455c6a35c65cb9