🔴 Multiple ModSecurity Vulnerabilities Let Attackers Bypass WAF Rules and Execute Malicious Requests

OWASP ModSecurity has disclosed multiple vulnerabilities that could let attackers bypass web application firewall rules, evade request and response inspection, or trigger denial-of-service conditions.

Not all of the newly published advisories currently have CVE identifiers; the project has indicated that CVE requests have been submitted via GitHub but remain unassigned for several issues.

The recently published advisory impacts ModSecurity’s version 3 engine, libmodsecurity3, and also affects some issues in the version 2 branch. Administrators should update to ModSecurity version 3.0.17 or version 2.9.15, depending on their deployment.