CVE-2025-47947
Last modified
CVE-2025-47947 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. EPSS estimates a 0.56% chance of exploitation in the next 30 days.
Description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Trustwave | Modsecurity | < 2.9.9 |
References
- https://github.com/owasp-modsecurity/ModSecurity/pull/3389Issue Tracking, Patch
- https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-859r-vvv8-rm8rExploit, Vendor Advisory
- https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-859r-vvv8-rm8rExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-47947?
How severe is CVE-2025-47947?
How do I fix CVE-2025-47947?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-47941TYPO3 is an open source, PHP based web content management sy…7.2
- CVE-2025-47942The Open edX Platform is a learning management platform. Pri…5.3
- CVE-2025-47943Gogs is an open source self-hosted Git service. In applicati…6.3
- CVE-2025-47944Multer is a node.js middleware for handling `multipart/form-…7.5
- CVE-2025-47945Donetick an open-source app for managing tasks and chores. P…9.8
- CVE-2025-47946Symfony UX is an initiative and set of libraries to integrat…6.1
- CVE-2025-47948Cocotais Bot is a QQ official robot framework based on qq-bo…7.2
- CVE-2025-47949samlify is a Node.js library for SAML single sign-on. A Sign…7.5
- CVE-2025-4795A vulnerability classified as critical has been found in gon…7.2
- CVE-2025-47950CoreDNS is a DNS server that chains plugins. In versions pri…7.5
- CVE-2025-47951Weblate is a web based localization tool. Prior to version 5…4.9
- CVE-2025-47952Traefik (pronounced traffic) is an HTTP reverse proxy and lo…9.1
Are you affected by CVE-2025-47947?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST