#VU112103 Buffer overflow in ModSecurity - CVE-2025-52891

Vulnerability identifier: #VU112103

Vulnerability risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-52891

CWE-ID: CWE-119

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
ModSecurity
Server applications / IDS/IPS systems, Firewalls and proxy servers

Vendor: Trustwave

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing XML data with an empty XML tag. A remote attacker can send specially crafted XML data to the web application protected with ModSecurity, trigger memory corruption and perform a denial of service (DoS) attack.

Note, the vulnerability affects installations with SecParseXmlIntoArgs set to "On" or "OnlyArgs", which is not the default configuration. 

Mitigation
Install updates from vendor's website.

Vulnerable software versions

ModSecurity: 2.9.8, 2.9.9, 2.9.10

---

External links
https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-gw9c-4wfm-vj3x
https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.11

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.