High severity · published May 21, 2025
CVE-2025-47947
ModSecurity Has Possible DoS Vulnerability
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
ModSecurity · owasp-modsecurity
<= 2.9.8 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-47947
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-47947
Issue Tracking
https://github.com/owasp-modsecurity/ModSecurity/pull/3389
Exploit
https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-859r-vvv8-rm8r
More from ModSecurity
8.6
CVE-2026-52747
ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass
7.5
CVE-2026-42268
ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators
7.5
CVE-2026-30923
libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings
7.5
CVE-2025-48866
ModSecurity has possible DoS vulnerability in sanitiseArg action
7.5
CVE-2025-27110
Libmodsecurity3 has possible bypass of encoded HTML entities