CVE-2025-52891: 
ModSecurity vulnerability analysis and mitigation

CVE-2025-52891 is a denial-of-service vulnerability in ModSecurity (mod_security2), an open-source WAF engine for Apache, IIS, and Nginx, caused by a segmentation fault triggered by empty XML tags during request parsing. It affects versions 2.9.8 through 2.9.10 (before 2.9.11) and was reported by Andrew Howe (@RedXanadu) and disclosed on July 1–2, 2025. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat). Oracle Solaris 11.4 is also listed as an affected platform (Oracle).

The root cause is improper input validation (CWE-20) in the XML argument parsing logic within apache2/msc_xml.c. When SecParseXmlIntoArgs is set to On or OnlyArgs and a request with Content-Type: application/xml contains at least one empty XML element (e.g., <foo></foo>), the currval pointer remains NULL and currvalbufflen is uninitialized, causing a strlen(NULL) dereference in the msc_xml_on_end_elementns handler that results in a segmentation fault. The fix, applied in commit ecd7b97, adds a currvalbufflen field to the parser state struct and guards against NULL currval by substituting an empty string before computing lengths (GitHub Advisory, GitHub Commit). Exploitation requires that an end user (or attacker acting as one) send a crafted XML request to a web application protected by the vulnerable ModSecurity configuration; the default value of SecParseXmlIntoArgs is Off, limiting exposure to explicitly configured deployments.

Successful exploitation causes the ModSecurity WAF process to crash via a segmentation fault, resulting in a denial of service with high availability impact and no confidentiality or integrity impact. A crash of the WAF may leave the protected web application temporarily unguarded, potentially exposing it to other attacks during the outage period. The vulnerability affects any web server (Apache, IIS, Nginx) running mod_security2 versions 2.9.8–2.9.10 with SecParseXmlIntoArgs enabled (GitHub Advisory, Red Hat).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.05%, reflecting very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify web servers running ModSecurity (mod_security2) versions 2.9.8–2.9.10 with SecParseXmlIntoArgs set to On or OnlyArgs — this can sometimes be inferred from server response headers or error messages.
2. Craft malicious request: Construct an HTTP POST (or other method) request targeting any endpoint on the protected application with the header Content-Type: application/xml.
3. Include empty XML tag: Ensure the XML body contains at least one empty element, e.g., <?xml version="1.0"?><root><foo></foo></root>.
4. Send the request: Transmit the crafted request to the target server. ModSecurity's XML parser will attempt to process the empty tag, dereference a NULL currval pointer, and trigger a segmentation fault, crashing the WAF process (GitHub Advisory, GitHub Commit).

• Logs: Segmentation fault entries in the Apache/Nginx error log (e.g., [error] ... Segmentation fault) coinciding with application/xml POST requests; ModSecurity audit log entries showing XML body parsing activity immediately before a crash.
• Process: Unexpected termination or restart of the Apache/Nginx worker process; core dump files generated in the server's working directory (e.g., core.* files).
• Network: Repeated HTTP requests with Content-Type: application/xml bodies containing empty XML elements (e.g., <tag></tag>) from the same source IP, particularly if the server crashes or becomes unresponsive after each request.

Upgrade ModSecurity (mod_security2) to version 2.9.11 or later, which contains the patch addressing the NULL pointer dereference (GitHub Advisory). As an immediate workaround, set SecParseXmlIntoArgs Off in the ModSecurity configuration — this is also the default value, so deployments that have not explicitly enabled this feature are not affected. OpenSUSE and Amazon Linux 2 have released updated packages (apache2-mod_security2 2.9.11), and cPanel EasyApache4 v25.22 also includes the fix (Linux Security, cPanel).

The vulnerability received coverage from multiple cybersecurity news outlets including CyberSecurityNews, GBHackers, CyberPress, and The Hacker News (in a weekly recap), generally characterizing it as a "critical" DoS risk despite its Medium CVSS score (CyberSecurityNews, GBHackers). The ModSecurity project published an official advisory on July 1, 2025, crediting researcher Andrew Howe (@RedXanadu) for the discovery (GitHub Advisory). Community discussion was noted on Mastodon (infosec.exchange) and Bluesky shortly after disclosure.