Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

The latest versions of both v2.9.x and v3.0.x are supported.

Reporting a Vulnerability

For information on how to report a security issue, please see https://github.com/owasp-modsecurity/ModSecurity#security-issue

Insufficient Return Value Handling on ModSecurity leads to XSS and Source Code Disclosure
GHSA-cg44-9m43-3f9v published Aug 5, 2025 by airween

Moderate
Empty XML tag causes segmentation fault
GHSA-gw9c-4wfm-vj3x published Jul 1, 2025 by airween

Moderate
Possible DoS vulnerability in sanitiseArg action
GHSA-f82j-8pp7-cw2w published Jun 2, 2025 by airween

High
Possible DoS vulnerability
GHSA-859r-vvv8-rm8r published May 21, 2025 by airween

High
Encoded HTML entities possible bypass
GHSA-42w7-rmv5-4x2j published Feb 25, 2025 by airween

High

Learn more about advisories related to owasp-modsecurity/ModSecurity in the GitHub Advisory Database