CVE-2025-52891 - CVE House

Back to Database

Status published Medium CVE-2025-52891

ModSecurity empty XML tag causes segmentation fault

6.5 CVSS

Vulnerability Description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-52891

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from owasp-modsecurity

View All →

ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure

ModSecurity has possible DoS vulnerability in sanitiseArg action

ModSecurity Has Possible DoS Vulnerability

Libmodsecurity3 has possible bypass of encoded HTML entities

Affected Vendor

owasp-modsecurity

View all reports →

Affected Software

ModSecurity

Vulnerable Versions:

>= 2.9.8, < 2.9.11

Timeline

Official Publish: July 2nd, 2025

Last Modified: July 2nd, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation