Medium severity · published Jul 2, 2025
CVE-2025-52891
ModSecurity empty XML tag causes segmentation fault
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
ModSecurity · owasp-modsecurity
>= 2.9.8, < 2.9.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-52891
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-52891
github.com
https://github.com/owasp-modsecurity/ModSecurity/commit/ecd7b9736836eee391d25f35d5bd06a3ce35a45d
github.com
https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-gw9c-4wfm-vj3x
More from ModSecurity
8.6
CVE-2026-52747
ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass
8.6
CVE-2024-1019
WAF bypass of the ModSecurity v3 release line
7.5
CVE-2026-42268
ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators
7.5
CVE-2026-30923
libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings
7.5
CVE-2025-48866
ModSecurity has possible DoS vulnerability in sanitiseArg action