CVE-2025-52891: ModSecurity WAF DoS Vulnerability

CVE-2025-52891 Overview

CVE-2025-52891 is a Denial of Service vulnerability in ModSecurity, the open source, cross-platform web application firewall (WAF) engine for Apache, IIS, and Nginx. The vulnerability exists in versions 2.9.8 through 2.9.10 and is triggered when parsing XML requests containing empty tags. When specific configuration options are enabled and a malformed XML request is processed, the WAF engine crashes due to a segmentation fault, potentially leaving web applications unprotected.

Critical Impact

This vulnerability allows remote attackers to crash the ModSecurity WAF engine by sending specially crafted XML requests with empty tags, potentially disrupting security monitoring and leaving web applications exposed to further attacks.

Affected Products

• ModSecurity version 2.9.8
• ModSecurity version 2.9.9
• ModSecurity version 2.9.10

Discovery Timeline

• 2025-07-02 - CVE CVE-2025-52891 published to NVD
• 2025-07-03 - Last updated in NVD database

Technical Details for CVE-2025-52891

Vulnerability Analysis

This vulnerability is classified as an Improper Input Validation issue (CWE-20) that results in a Denial of Service condition. The flaw occurs in ModSecurity's XML parsing functionality, specifically when the SecParseXmlIntoArgs directive is set to On or OnlyArgs. When processing application/xml content type requests containing at least one empty XML tag (e.g., <foo></foo>), the parser fails to properly handle the edge case, leading to a segmentation fault.

The vulnerability can be exploited remotely without authentication, though user interaction is required. Successful exploitation crashes the ModSecurity process, causing an availability impact while confidentiality and integrity remain unaffected. Organizations relying on ModSecurity for web application protection could find their security layer temporarily disabled during an attack.

Root Cause

The root cause lies in the XML parser state machine within apache2/msc_xml.c. The parser improperly tracks buffer lengths when processing XML tag content. Specifically, the currpathbufflen and currvalbufflen variables in the XML parser state structure were not correctly maintained when encountering empty XML tags, leading to a null pointer dereference when the parser attempted to access uninitialized memory.

Attack Vector

An attacker can exploit this vulnerability by sending HTTP POST requests with Content-Type: application/xml containing XML payloads with one or more empty tags. The attack is network-based and does not require authentication, though it does require specific server configuration where SecParseXmlIntoArgs is enabled.

<!-- Example malicious XML payload triggering the vulnerability -->
<?xml version="1.0"?>
<root>
  <foo></foo>
  <!-- Empty tag causes segmentation fault -->
</root>

The security patch addresses this by properly tracking buffer lengths in the XML parser state:

     xml_parser_state->pathlen += (taglen + 1);
     char *newpath = apr_pstrcat(msr->mp, xml_parser_state->currpath, ".", (char *)localname, NULL);
     xml_parser_state->currpath = newpath;
+    xml_parser_state->currpathbufflen += taglen + 1; // +1 for the '.' character here too

     int *new_stack_item = (int *)apr_array_push(xml_parser_state->has_child_stack);
     *new_stack_item = 0;

Source: GitHub ModSecurity Commit

Additionally, the patch adds proper tracking for the value buffer length in the header file:

     char               * currpath;
     char               * currval;
     size_t               currpathbufflen;
+    size_t               currvalbufflen;
     apr_pool_t         * mp;
};

Source: GitHub ModSecurity Commit

Detection Methods for CVE-2025-52891

Indicators of Compromise

• Unexpected ModSecurity process crashes or restarts in server logs
• HTTP 500 errors or connection resets following XML POST requests
• Segmentation fault messages in Apache, IIS, or Nginx error logs referencing ModSecurity modules
• Spike in application/xml content-type requests containing minimal or empty XML structures

Detection Strategies

• Monitor web server error logs for segmentation fault signals (SIGSEGV) associated with ModSecurity modules
• Implement log analysis rules to detect patterns of XML requests immediately preceding WAF crashes
• Configure alerting on unexpected ModSecurity process terminations using process monitoring tools
• Review access logs for requests with Content-Type: application/xml and small payload sizes

Monitoring Recommendations

• Enable verbose logging for ModSecurity to capture detailed request information before crashes occur
• Configure automated WAF health checks to detect when ModSecurity protection becomes unavailable
• Implement real-time monitoring of web server process stability and automatic restart policies
• Set up network intrusion detection rules to identify potential exploit attempts targeting XML parsing

How to Mitigate CVE-2025-52891

Immediate Actions Required

• Upgrade ModSecurity to version 2.9.11 or later immediately
• If immediate upgrade is not possible, disable XML argument parsing by setting SecParseXmlIntoArgs Off
• Review and audit all ModSecurity configuration files for SecParseXmlIntoArgs directive settings
• Implement upstream filtering to block or sanitize XML requests with empty tags if the workaround cannot be applied

Patch Information

The vulnerability has been patched in ModSecurity version 2.9.11. The fix ensures proper buffer length tracking in the XML parser state structure, preventing the segmentation fault when processing empty XML tags. Organizations should apply the patch by upgrading to the latest version. For more details, refer to the GitHub Security Advisory GHSA-gw9c-4wfm-vj3x.

Workarounds

• Disable XML argument parsing by adding SecParseXmlIntoArgs Off to the ModSecurity configuration
• Implement request filtering at a reverse proxy layer to reject XML requests with empty tags before they reach ModSecurity
• Use network-level rate limiting on application/xml requests to reduce potential DoS impact
• Deploy redundant WAF instances to maintain protection if one instance crashes

# Configuration example - Disable XML argument parsing in ModSecurity
# Add to modsecurity.conf or relevant configuration file

# Disable XML parsing into arguments (workaround for CVE-2025-52891)
SecParseXmlIntoArgs Off

# Alternatively, if XML parsing is required, upgrade to patched version:
# yum update mod_security  (RHEL/CentOS)
# apt-get upgrade libapache2-mod-security2  (Debian/Ubuntu)