| Name | CVE-2025-52891 |
| Description | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1108715 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| modsecurity-apache (PTS) | bullseye | 2.9.3-3+deb11u2 | fixed |
| bullseye (security) | 2.9.3-3+deb11u4 | fixed | |
| bookworm | 2.9.7-1 | fixed | |
| bookworm (security) | 2.9.7-1+deb12u1 | fixed | |
| trixie, sid | 2.9.11-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| modsecurity-apache | source | bullseye | (not affected) | |||
| modsecurity-apache | source | bookworm | (not affected) | |||
| modsecurity-apache | source | (unstable) | 2.9.11-1 | 1108715 |
[bookworm] - modsecurity-apache <not-affected> (Vulnerable code introduced later)
[bullseye] - modsecurity-apache <not-affected> (Vulnerable code introduced later)
https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-gw9c-4wfm-vj3x
Introduced with: https://github.com/owasp-modsecurity/ModSecurity/commit/0c8cc6e2cf88ba2da48dffe29807521c36ed8ce1 (v2.9.9)
Fixed by: https://github.com/owasp-modsecurity/ModSecurity/commit/ca99ccd23fd92c002a3901e890b4b6ea394f292b (v2.9.11)
Fixed by: https://github.com/owasp-modsecurity/ModSecurity/commit/89d3ad38c5a964f760af240e3ace3467bb729a64 (v2.9.11)
Fixed by: https://github.com/owasp-modsecurity/ModSecurity/commit/f9e81f2c78188b486dee6d76fd274d06e15d0a71 (v2.9.11)
Fixed by: https://github.com/owasp-modsecurity/ModSecurity/commit/8cb7fc82fecd182369bcffd93ab81f48d9c0a18c (v2.9.11)
Fixed by: https://github.com/owasp-modsecurity/ModSecurity/commit/e56d62960eee41e4ed92c8acafe5cad80047601a (v2.9.11)
Fixed by: https://github.com/owasp-modsecurity/ModSecurity/commit/8879413abf507b1921f6feb292ee91e0f0064b01 (v2.9.11)