CVE-2025-47947

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1050

Affected software

No affected versions have been published.

Timeline

Published: May 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-479487.2Cocotais Bot is a QQ official robot framework based on qq-bot-sdk. Starting in version 1.5.0-test2-hotfix and prior to version 1.6.2, comman CVE-2025-479497.5samlify is a Node.js library for SAML single sign-on. A Signature Wrapping attack has been found in samlify prior to version 2.10.0, allowin CVE-2025-47957.2A vulnerability classified as critical has been found in gongfuxiang schoolcms 2.3.1. This affects the function SaveInfo of the file /index.CVE-2025-479507.5CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service (DoS) vulnerability exists in the CoreDNS DNS-CVE-2025-479514.9Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The CVE-2025-479529.1Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Prior to versions 2.11.25 and 3.4.1, there is a potential vulnerabi CVE-2025-479538.4Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-479548.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate CVE-2025-479557.8Improper privilege management in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.CVE-2025-479565.5External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally.CVE-2025-479578.4Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-479597.1Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execut