CVE-2025-52891

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jul 2, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-528926.5EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 CVE-2025-528934.5OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. Ope CVE-2025-528947.5OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. Ope CVE-2025-528957.5Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, SQL injection could be achieved via a specially cra CVE-2025-528965.4Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted CVE-2025-528976.1GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious lin CVE-2025-528988.8Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, a carefully crafted request could lead to a malicio CVE-2025-528995.3Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior CVE-2025-52906.4The Borderless – Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter CVE-2025-529005.5File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit CVE-2025-529016.5File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit CVE-2025-529025.4File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit