CVE-2023-28882
Fixed in a distro release EPSS <1%CVSS 7.5
Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.
Products: owasp modsecurity
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | modsecurity | 3.0.9-r0 |
| Debian 12 | modsecurity | 3.0.9-1 |
| Debian 13 | modsecurity | 3.0.9-1 |
| Debian 14 | modsecurity | 3.0.9-1 |
| SUSE Package Hub 15 SP4 | modsecurity | 3.0.10-bp154.2.3.1 |
| SUSE Package Hub 15 SP5 | modsecurity | 3.0.10-bp155.3.3.1 |
| Ubuntu 20.04 LTS | modsecurity | no fix |
| Ubuntu 22.04 LTS | modsecurity | no fix |
| Ubuntu 24.04 LTS | modsecurity | no fix |
| Ubuntu 25.10 | modsecurity | no fix |
| Ubuntu 26.04 LTS | modsecurity | no fix |
| Ubuntu 26.10 | modsecurity | no fix |
| Wolfi | modsecurity | 3.0.9-r0 |
| openSUSE Leap 15.4 | modsecurity | 3.0.10-bp154.2.3.1 |
| openSUSE Leap 15.5 | modsecurity | 3.0.10-bp155.3.3.1 |