Changes in v2.9.9: There is a DoS vulnerability in previous versions, see CVE 2025-47947. This release includes a fix for it. fix: DoS vulnerability [PR from private repo - @theseion , @fzipi , @airween ; fixed CVE-2025-47947] chore: log error codes for global mutex failure modes. [Issue #3387 - @airween ] chore: refactor build system to use PCRE2 [Issue #3383 - @airween ] feat: add 'make test' to v2's workflow [Issue #3379 - @airween ] fix: 'make test' is able to run again [Issue #3378 - @airween ] fix: add PCRE2 capability to standalone module [Issue #3377 - @airween ] chore: remove unnecessary @LIBXML2_CFLAGS@ from linker flags [Issue #3376 - @airween ] fix: add msc_fullinfo() to check JIT compilation [Issue #3375 - @airween ] Fix error logging for standalone module [Issue #3374 - @RedXanadu ] Fix compiler warnings from GCC [Issue #3372 - @notroj ] feat: improved XMLArgs processing [Issue #3358 - @airween ] Incorrect utf8toUnicode transformation for 00xx [Issue #3284 - @marcstern ] Fixed PCRE2 error message [Issue #3279 - @marcstern ] make rootpath and incpath consts for apr_filepath_root [Issue #3270 - @Marcool04 ] Fix apr_global_mutex_create() usage [Issue #3269 - @marcstern ] chore: add 'log' action to rule 200005 (v2/master) [Issue #3267 - @airween ] Move id_log() to msc_util to fix unit tests; it is declared on msc_ut… [Issue #3265 - @rainerjung ] Missing #include <time.h> [Issue #3262 - @marcstern ] Fixed apr_global_mutex_create() usage (no filename) [PR #3269 - @marcstern ] handle errors from apr_global_mutex_lock [PR #3257 - @marcstern ] Special thanks to @theseion and @fzipi for their big help, and all other participants.
v2.9.9
Inhalt
Verknuepfte CVEs
| CVE-ID | Severity (CVE.org) | CVSS (CVE.org) | EPSS | EPSS-% | Veroeffentlicht (CVE.org) |
|---|---|---|---|---|---|
| HIGH | 7.5 | - | - | 2025-05-21 |
Quellen-Details
| Bezeichnung | Name | Kategorie | Tags | Zielgruppe | Sprache | Feed-URL |
|---|---|---|---|---|---|---|
| OWASP ModSecurity Releases | vendor_advisory | waf, modsecurity, owasp | - | de | https://github.com/owasp-modsecurity/ModSecurity/releases.atom |