CVE-2025-48866 - CVE House
Back to Database
Status published High CVE-2025-48866

ModSecurity has possible DoS vulnerability in sanitiseArg action

Vulnerability Description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the `sanitiseArg` (or `sanitizeArg`) action.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-48866

Credits & Attribution

No credits recorded in the NVD database.

References

More from owasp-modsecurity

View All →
CVE-2025-54571
ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure
Medium 6.9
CVE-2025-52891
ModSecurity empty XML tag causes segmentation fault
Medium 6.5
CVE-2025-47947
ModSecurity Has Possible DoS Vulnerability
High 7.5
CVE-2025-27110
Libmodsecurity3 has possible bypass of encoded HTML entities
High 7.9

Affected Vendor

owasp-modsecurity

View all reports →

Affected Software

ModSecurity
Vulnerable Versions:
< 2.9.10

Timeline

Official Publish: June 2nd, 2025
Last Modified: June 9th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-1050

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.