CVE-2023-28882 Denial of service in n/a
Attackers can cause a denial of service by triggering a segmentation fault in ModSecurity, affecting web servers using this firewall.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-28882?
CVE-2023-28882 is a high-severity denial of service vulnerability in n/a, published on 28 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.
Which versions are affected by CVE-2023-28882?
2 open source packages ship an affected version, including modsecurity and modsecurity2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
modsecurity Bitnami | From 3.0.5 | 3.0.9 |
modsecurity2 Bitnami | From 3.0.5 | 3.0.9 |
Products include Owasp Modsecurity.
How do I fix CVE-2023-28882?
Upgrade modsecurity to 3.0.9 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-28882 being exploited?
There is no known exploitation of CVE-2023-28882 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-52747 Security feature bypass in ModSecurity
- CVE-2024-1019 WAF bypass of the ModSecurity v3 release line
- CVE-2026-42268 ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators
- CVE-2026-30923 libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings
- CVE-2025-48866 ModSecurity has possible DoS vulnerability in sanitiseArg action
Sources
Also known as BIT-modsecurity-2023-28882, BIT-modsecurity2-2023-28882, DEBIAN-CVE-2023-28882, GHSA-wgcm-rvmx-wh95, UBUNTU-CVE-2023-28882, openSUSE-SU-2024:12937-1.