CVE & CISA-KEV Catalog

CVE-2025-47947

HIGH

7.5

CVSS v3

Description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.

How to fix

Remediation Available

modsecurity-apacheDebian

Fixed in:2.9.3-3+deb11u3CVE-2025-47947

Fixed in:2.9.7-1+deb12u1CVE-2025-47947

Fixed in:2.9.9-1CVE-2025-47947

Fixed in:2.9.9-1CVE-2025-47947

jbcs-httpd24-httpdRed Hat / RHEL

Fixed in:0:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-httpdRocky

Fixed in:0:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-httpd-debuginfoRed Hat / RHEL

Fixed in:0:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-httpd-debuginfoRocky

Fixed in:0:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-httpd-develRed Hat / RHEL

Fixed in:0:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-httpd-develRocky

Fixed in:0:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-httpd-manualRocky

Fixed in:0:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-httpd-manualRed Hat / RHEL

Fixed in:0:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-httpd-selinuxRed Hat / RHEL

Fixed in:0:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-httpd-selinuxRocky

Fixed in:0:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-httpd-toolsRed Hat / RHEL

Fixed in:0:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-httpd-toolsRocky

Fixed in:0:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-httpd-tools-debuginfoRocky

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-httpd-tools-debuginfoRed Hat / RHEL

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_http2Rocky

Fixed in:0:2.0.29-5.el7jbcsRHSA-2025:13680

Fixed in:0:2.0.29-5.el7jbcsRHSA-2025:13680

Fixed in:0:2.0.29-5.el8jbcsRHSA-2025:13680

Fixed in:0:2.0.29-5.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_http2Red Hat / RHEL

Fixed in:0:2.0.29-5.el7jbcsRHSA-2025:13680

Fixed in:0:2.0.29-5.el7jbcsRHSA-2025:13680

Fixed in:0:2.0.29-5.el8jbcsRHSA-2025:13680

Fixed in:0:2.0.29-5.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_http2-debuginfoRocky

Fixed in:0:2.0.29-5.el7jbcsRHSA-2025:13680

Fixed in:0:2.0.29-5.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_http2-debuginfoRed Hat / RHEL

Fixed in:0:2.0.29-5.el7jbcsRHSA-2025:13680

Fixed in:0:2.0.29-5.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_jkRocky

Fixed in:0:1.2.50-9.redhat_1.el7jbcsRHSA-2025:13680

Fixed in:0:1.2.50-9.redhat_1.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_jkRed Hat / RHEL

Fixed in:0:1.2.50-9.redhat_1.el7jbcsRHSA-2025:13680

Fixed in:0:1.2.50-9.redhat_1.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_jk-ap24Red Hat / RHEL

Fixed in:0:1.2.50-9.redhat_1.el7jbcsRHSA-2025:13680

Fixed in:0:1.2.50-9.redhat_1.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_jk-ap24Rocky

Fixed in:0:1.2.50-9.redhat_1.el7jbcsRHSA-2025:13680

Fixed in:0:1.2.50-9.redhat_1.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_jk-ap24-debuginfoRed Hat / RHEL

Fixed in:0:1.2.50-9.redhat_1.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_jk-ap24-debuginfoRocky

Fixed in:0:1.2.50-9.redhat_1.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_jk-debuginfoRed Hat / RHEL

Fixed in:0:1.2.50-9.redhat_1.el7jbcsRHSA-2025:13680

jbcs-httpd24-mod_jk-debuginfoRocky

Fixed in:0:1.2.50-9.redhat_1.el7jbcsRHSA-2025:13680

jbcs-httpd24-mod_ldapRocky

Fixed in:0:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_ldapRed Hat / RHEL

Fixed in:0:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_ldap-debuginfoRocky

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_ldap-debuginfoRed Hat / RHEL

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_mdRed Hat / RHEL

Fixed in:1:2.4.28-10.el7jbcsRHSA-2025:13680

Fixed in:1:2.4.28-10.el7jbcsRHSA-2025:13680

Fixed in:1:2.4.28-10.el8jbcsRHSA-2025:13680

Fixed in:1:2.4.28-10.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_mdRocky

Fixed in:1:2.4.28-10.el7jbcsRHSA-2025:13680

Fixed in:1:2.4.28-10.el7jbcsRHSA-2025:13680

Fixed in:1:2.4.28-10.el8jbcsRHSA-2025:13680

Fixed in:1:2.4.28-10.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_md-debuginfoRocky

Fixed in:1:2.4.28-10.el7jbcsRHSA-2025:13680

Fixed in:1:2.4.28-10.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_md-debuginfoRed Hat / RHEL

Fixed in:1:2.4.28-10.el7jbcsRHSA-2025:13680

Fixed in:1:2.4.28-10.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_proxy_clusterRed Hat / RHEL

Fixed in:0:1.3.22-4.el7jbcsRHSA-2025:13680

Fixed in:0:1.3.22-4.el7jbcsRHSA-2025:13680

Fixed in:0:1.3.22-4.el8jbcsRHSA-2025:13680

Fixed in:0:1.3.22-4.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_proxy_clusterRocky

Fixed in:0:1.3.22-4.el7jbcsRHSA-2025:13680

Fixed in:0:1.3.22-4.el7jbcsRHSA-2025:13680

Fixed in:0:1.3.22-4.el8jbcsRHSA-2025:13680

Fixed in:0:1.3.22-4.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_proxy_cluster-debuginfoRocky

Fixed in:0:1.3.22-4.el7jbcsRHSA-2025:13680

Fixed in:0:1.3.22-4.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_proxy_cluster-debuginfoRed Hat / RHEL

Fixed in:0:1.3.22-4.el7jbcsRHSA-2025:13680

Fixed in:0:1.3.22-4.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_proxy_htmlRocky

Fixed in:1:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:1:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_proxy_htmlRed Hat / RHEL

Fixed in:1:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:1:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_proxy_html-debuginfoRocky

Fixed in:1:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_proxy_html-debuginfoRed Hat / RHEL

Fixed in:1:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_securityRocky

Fixed in:0:2.9.6-11.el7jbcsRHSA-2025:13680

Fixed in:0:2.9.6-11.el7jbcsRHSA-2025:13680

Fixed in:0:2.9.6-11.el8jbcsRHSA-2025:13680

Fixed in:0:2.9.6-11.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_securityRed Hat / RHEL

Fixed in:0:2.9.6-11.el7jbcsRHSA-2025:13680

Fixed in:0:2.9.6-11.el7jbcsRHSA-2025:13680

Fixed in:0:2.9.6-11.el8jbcsRHSA-2025:13680

Fixed in:0:2.9.6-11.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_security-debuginfoRocky

Fixed in:0:2.9.6-11.el7jbcsRHSA-2025:13680

Fixed in:0:2.9.6-11.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_security-debuginfoRed Hat / RHEL

Fixed in:0:2.9.6-11.el7jbcsRHSA-2025:13680

Fixed in:0:2.9.6-11.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_sessionRed Hat / RHEL

Fixed in:0:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_sessionRocky

Fixed in:0:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_session-debuginfoRed Hat / RHEL

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_session-debuginfoRocky

Fixed in:0:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_sslRocky

Fixed in:1:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:1:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_sslRed Hat / RHEL

Fixed in:1:2.4.62-8.el7jbcsRHSA-2025:13680

Fixed in:1:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_ssl-debuginfoRocky

Fixed in:1:2.4.62-8.el8jbcsRHSA-2025:13680

jbcs-httpd24-mod_ssl-debuginfoRed Hat / RHEL

Fixed in:1:2.4.62-8.el8jbcsRHSA-2025:13680

mod_securityRed Hat / RHEL

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.2-8.el8_2.1RHSA-2025:8626

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.2-9.el8_4.1RHSA-2025:8627

Fixed in:0:2.9.2-9.el8_4.1RHSA-2025:8627

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.2-8.el8_2.1RHSA-2025:8626

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

mod_securityRocky

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.2-8.el8_2.1RHSA-2025:8626

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.2-8.el8_2.1RHSA-2025:8626

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.2-9.el8_4.1RHSA-2025:8627

Fixed in:0:2.9.2-9.el8_4.1RHSA-2025:8627

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

mod_security-debuginfoRed Hat / RHEL

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.2-9.el8_4.1RHSA-2025:8627

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.2-8.el8_2.1RHSA-2025:8626

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

mod_security-debuginfoRocky

Fixed in:0:2.9.2-9.el8_4.1RHSA-2025:8627

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.2-8.el8_2.1RHSA-2025:8626

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

mod_security-debugsourceRed Hat / RHEL

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.2-8.el8_2.1RHSA-2025:8626

Fixed in:0:2.9.2-9.el8_4.1RHSA-2025:8627

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

mod_security-debugsourceRocky

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.2-8.el8_2.1RHSA-2025:8626

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.2-9.el8_4.1RHSA-2025:8627

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

mod_security-mlogcRed Hat / RHEL

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.2-9.el8_4.1RHSA-2025:8627

Fixed in:0:2.9.2-8.el8_2.1RHSA-2025:8626

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

mod_security-mlogcRocky

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.2-9.el8_4.1RHSA-2025:8627

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.2-8.el8_2.1RHSA-2025:8626

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

mod_security-mlogc-debuginfoRed Hat / RHEL

Fixed in:0:2.9.2-9.el8_4.1RHSA-2025:8627

Fixed in:0:2.9.2-8.el8_2.1RHSA-2025:8626

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

mod_security-mlogc-debuginfoRocky

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-1.el8_8.1RHSA-2025:8674

Fixed in:0:2.9.2-8.el8_2.1RHSA-2025:8626

Fixed in:0:2.9.2-9.el8_4.1RHSA-2025:8627

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.6-2.el8_10RHSA-2025:8844

Fixed in:0:2.9.2-9.el8_6.1RHSA-2025:8605

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_4.1RHSA-2025:8917

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-1.el9_2.1RHSA-2025:8937

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.6-2.el9_6RHSA-2025:8837

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

Fixed in:0:2.9.3-12.el9_0.1RHSA-2025:8922

libapache2-mod-security2Ubuntu

Fixed in:2.7.7-2ubuntu0.1~esm2USN-7567-1

Fixed in:2.9.0-1ubuntu0.1~esm2USN-7567-1

Fixed in:2.9.2-1ubuntu0.1~esm2USN-7567-1

Fixed in:2.9.3-1ubuntu0.1+esm1USN-7567-1

Fixed in:2.9.5-1ubuntu0.1~esm2USN-7567-1

Fixed in:2.9.7-1ubuntu0.24.04.1~esm1USN-7567-1

libapache2-modsecurityUbuntu

Fixed in:2.7.7-2ubuntu0.1~esm2USN-7567-1

Fixed in:2.9.0-1ubuntu0.1~esm2USN-7567-1

modsecurity-apacheUbuntu

Fixed in:2.7.7-2ubuntu0.1~esm2USN-7567-1

Fixed in:2.9.0-1ubuntu0.1~esm2USN-7567-1

Fixed in:2.9.2-1ubuntu0.1~esm2USN-7567-1

Fixed in:2.9.3-1ubuntu0.1+esm1USN-7567-1

Fixed in:2.9.5-1ubuntu0.1~esm2USN-7567-1

Fixed in:2.9.7-1ubuntu0.24.04.1~esm1USN-7567-1

TridentStack Control can deploy fixes like this automatically across your Windows, macOS, and Linux fleet. See how it works

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityNone

IntegrityNone

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploit Intelligence

0.59%probability of exploitation in 30 days

45thpercentile

Moderate risk: more likely to be exploited than 45% of all known CVEs.

References

Patch1

github.com

Exploit1

github.com

Related Vulnerabilities

Other CWE-1050 vulnerabilities, ordered by exploit likelihood. View all

CVE	Severity	CVSS	EPSS	Exploited	Fix
CVE-2023-1390	High	7.5	5.1%	-	Fix
CVE-2019-11254	Medium	6.5	2.4%	-	Fix
CVE-2024-4068	High	7.5	1.5%	-	Fix
CVE-2021-41039	High	7.5	1.3%	-	Fix
CVE-2025-48866	High	7.5	0.8%	-	Fix
CVE-2026-48779	High	7.5	0.8%	-	Fix

Common questions

How do I fix CVE-2025-47947?

Published advisories record a fix for 68 affected products. The "How to fix" section on this page lists the fixed version and source advisory for each one, so apply the entry matching what you actually run.

Is CVE-2025-47947 being actively exploited?

Not that we know of. CVE-2025-47947 is not in the CISA Known Exploited Vulnerabilities catalog. Its EPSS score of 0.59% is the estimated probability that it will be exploited in the next 30 days. That is higher than 45% of all scored CVEs.

How severe is CVE-2025-47947?

CVE-2025-47947 has a CVSS v3 base score of 7.5, rated high. CVSS rates the technical impact if the vulnerability is exploited, not how likely that is, so weigh it alongside the exploit-prediction score when you decide what to patch first.

What does CVE-2025-47947 affect?

Published advisories record a fix for modsecurity-apache (Debian), jbcs-httpd24-httpd (Red Hat / RHEL), jbcs-httpd24-httpd (Rocky), jbcs-httpd24-httpd-debuginfo (Red Hat / RHEL), and 64 more. Only products with a sourced advisory are listed, so treat this as what we can cite rather than a complete inventory.

Embed a live status badge for CVE-2025-47947

Markdown

[![CVE-2025-47947](https://tridentstack.com/cve/badge/CVE-2025-47947.svg)](https://tridentstack.com/cve/CVE-2025-47947)

HTML

<a href="https://tridentstack.com/cve/CVE-2025-47947"><img src="https://tridentstack.com/cve/badge/CVE-2025-47947.svg" alt="CVE-2025-47947"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

See how it works Start freeThis CVE lookup is free and always will be.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-06-20.