ModSecurity WAF Bypass

The vulnerability of the network firewall for protecting web applications related to ModSecurity lies in insufficient validation of input data during the processing of the SecParseXmlIntoArgs parameter. Exploiting this vulnerability allows a malicious actor to bypass the rules of the WAF...

Unity Linux 20.1070e Security Update: mod_security (UTSA-2025-993341)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993341 advisory. ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can...

CVE-2025-52891

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least...

CVE-2025-52891: Improper Input Validation

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least...