CVE-2025-52891

NameCVE-2025-52891
DescriptionModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1108715

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
modsecurity-apache (PTS)bullseye2.9.3-3+deb11u2fixed
bullseye (security)2.9.3-3+deb11u4fixed
bookworm2.9.7-1fixed
bookworm (security)2.9.7-1+deb12u1fixed
sid, trixie2.9.11-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
modsecurity-apachesourcebullseye(not affected)
modsecurity-apachesourcebookworm(not affected)
modsecurity-apachesource(unstable)2.9.11-11108715

Notes

[bookworm] - modsecurity-apache <not-affected> (Vulnerable code introduced later)
[bullseye] - modsecurity-apache <not-affected> (Vulnerable code introduced later)
https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-gw9c-4wfm-vj3x
Introduced with: https://github.com/owasp-modsecurity/ModSecurity/commit/0c8cc6e2cf88ba2da48dffe29807521c36ed8ce1 (v2.9.9)
Fixed by: https://github.com/owasp-modsecurity/ModSecurity/commit/ca99ccd23fd92c002a3901e890b4b6ea394f292b (v2.9.11)
Fixed by: https://github.com/owasp-modsecurity/ModSecurity/commit/89d3ad38c5a964f760af240e3ace3467bb729a64 (v2.9.11)
Fixed by: https://github.com/owasp-modsecurity/ModSecurity/commit/f9e81f2c78188b486dee6d76fd274d06e15d0a71 (v2.9.11)
Fixed by: https://github.com/owasp-modsecurity/ModSecurity/commit/8cb7fc82fecd182369bcffd93ab81f48d9c0a18c (v2.9.11)
Fixed by: https://github.com/owasp-modsecurity/ModSecurity/commit/e56d62960eee41e4ed92c8acafe5cad80047601a (v2.9.11)
Fixed by: https://github.com/owasp-modsecurity/ModSecurity/commit/8879413abf507b1921f6feb292ee91e0f0064b01 (v2.9.11)

Search for package or bug name: Reporting problems