CVE-2025-52891 ModSecurity empty XML tag causes segmentation fault
An attacker can cause a segmentation fault and denial of service in ModSecurity by sending an empty XML tag when XML parsing is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-52891?
CVE-2025-52891 is a medium-severity denial of service vulnerability in owasp-modsecurity ModSecurity, published on 2 Jul 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.
Weakness: CWE-20
Which versions are affected by CVE-2025-52891?
2 open source packages ship an affected version, including modsecurity and modsecurity2.
| Package | Affected | Fixed in |
|---|---|---|
modsecurity Bitnami | From 2.9.8 | 3.0.12 |
modsecurity2 Bitnami | From 2.9.8 | 2.9.11 |
Linux distribution packages (1)
apache2-mod_security2 openSUSE:Tumbleweed | All versions | 2.9.11-1.1 |
How do I fix CVE-2025-52891?
Upgrade modsecurity to 3.0.12 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-52891 being exploited?
There is no known exploitation of CVE-2025-52891 in the wild and no public exploit code.
Sources
Also known as BIT-modsecurity-2025-52891, BIT-modsecurity2-2025-52891, DEBIAN-CVE-2025-52891, GHSA-gw9c-4wfm-vj3x, OESA-2025-1751, OESA-2025-1752 and 5 more.