CVE-2025-52891: ModSecurity empty XML tag causes segmentation fault
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52891?
CVE-2025-52891 has been identified as a high severity vulnerability due to its potential to cause a segmentation fault.
How do I fix CVE-2025-52891?
To fix CVE-2025-52891, upgrade ModSecurity to version 2.9.11 or later.
What are the affected versions for CVE-2025-52891?
CVE-2025-52891 affects ModSecurity versions from 2.9.8 up to, but not including, 2.9.11.
What impact does CVE-2025-52891 have on web applications?
CVE-2025-52891 can potentially lead to application crashes and service disruption if exploited.
Is CVE-2025-52891 related to XML processing in ModSecurity?
Yes, CVE-2025-52891 is triggered by an empty XML tag when the SecParseXmlIntoArgs directive is enabled.