v2.9.9

Kurzinfo

Metadaten

  • Original (extern): Link oeffnen
  • Veroeffentlicht: 2025-05-21 19:57 UTC
  • Importiert: 2026-09-30 08:37 UTC
  • CVSS: 7.5
  • Quelle-ID: owasp_modsecurity
  • uid_hash: 37dbf50ce46d66f7659344da4eabc19cf4e51e3e358e05d696183ad60cb8f020

Inhalt

Changes in v2.9.9:

There is a DoS vulnerability in previous versions, see CVE 2025-47947. This release includes a fix for it.

fix: DoS vulnerability

[PR from private repo - @theseion, @fzipi, @airween; fixed CVE-2025-47947]

chore: log error codes for global mutex failure modes.

[Issue #3387 - @airween]

chore: refactor build system to use PCRE2

[Issue #3383 - @airween]

feat: add 'make test' to v2's workflow

[Issue #3379 - @airween]

fix: 'make test' is able to run again

[Issue #3378 - @airween]

fix: add PCRE2 capability to standalone module

[Issue #3377 - @airween]

chore: remove unnecessary @LIBXML2_CFLAGS@ from linker flags

[Issue #3376 - @airween]

fix: add msc_fullinfo() to check JIT compilation

[Issue #3375 - @airween]

Fix error logging for standalone module

[Issue #3374 - @RedXanadu]

Fix compiler warnings from GCC

[Issue #3372 - @notroj]

feat: improved XMLArgs processing

[Issue #3358 - @airween]

Incorrect utf8toUnicode transformation for 00xx

[Issue #3284 - @marcstern]

Fixed PCRE2 error message

[Issue #3279 - @marcstern]

make rootpath and incpath consts for apr_filepath_root

[Issue #3270 - @Marcool04]

Fix apr_global_mutex_create() usage

[Issue #3269 - @marcstern]

chore: add 'log' action to rule 200005 (v2/master)

[Issue #3267 - @airween]

Move id_log() to msc_util to fix unit tests; it is declared on msc_ut…

[Issue #3265 - @rainerjung]

Missing #include <time.h>

[Issue #3262 - @marcstern]

Fixed apr_global_mutex_create() usage (no filename)

[PR #3269 - @marcstern]

handle errors from apr_global_mutex_lock

[PR #3257 - @marcstern]

Special thanks to @theseion and @fzipi for their big help, and all other participants.

Verknuepfte CVEs

CVE-ID Severity (Quelle) CVSS (Quelle) Severity (CVE.org) CVSS (CVE.org) EPSS EPSS-Pctl Veroeffentlicht (CVE.org)

CVE-2025-47947

HIGH

7.5

HIGH

7.5

2025-05-21

Quellen-Details

Bezeichnung Name Kategorie Tags Zielgruppe Sprache Feed-URL
OWASP ModSecurity Releases

owasp_modsecurity

vendor_advisory waf, modsecurity, owasp - de https://github.com/owasp-modsecurity/ModSecurity/releases.atom