Owasp Modsecurity
15 CVEs affecting Owasp Modsecurity. Latest disclosed: 2026-07-10. Critical: 0, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-52747 | High | 8.6 | 2026-07-10 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request… |
CVE-2024-1019 | High | 8.6 | 2024-01-30 | ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 d… |
CVE-2026-42268 | High | 7.5 | 2026-05-12 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandl… |
CVE-2026-30923 | High | 7.5 | 2026-05-05 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Libmodsecurity is one component of the ModSecuri… |
CVE-2025-48866 | High | 7.5 | 2025-06-02 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of ser… |
CVE-2023-38285 | High | 7.5 | 2023-07-26 | Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity. |
CVE-2023-28882 | High | 7.5 | 2023-04-28 | Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in t… |
CVE-2022-48279 | High | 7.5 | 2023-01-20 | In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is… |
CVE-2021-42717 | High | 7.5 | 2021-12-07 | ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web serv… |
CVE-2020-15598 | High | 7.5 | 2020-10-06 | Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing… |
CVE-2019-19886 | High | 7.5 | 2020-01-21 | Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming… |
CVE-2025-54571 | Medium | 6.1 | 2025-08-06 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can ov… |
CVE-2018-13065 | Medium | 6.1 | 2018-07-03 | ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. NOTE: a third party has disputed this issue because it may only apply to environments wit… |
CVE-2026-52761 | Medium | 5.8 | 2026-07-10 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode t… |
CVE-2019-25043 | Medium | 5.3 | 2021-05-06 | ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string index out of range" error and worker-process crash for a "Cookie… |