@ModSecurity

Open-source Web Application Firewall maintained by OWASP. Blocking threats since 2002. Free, community-driven, expert-led, and actively developed.

 Earth
modsecurity.org
Joined April 2009
  • Tweets1.6K
  • Following18
  • Followers4.6K
10Media
Please welcome the latest releases of ModSecurity. github.com/owasp-modsecurity… github.com/owasp-modsecurity… And before you update, please read the relevant blog post: modsecurity.org/20260928/sec…

Release v3.0.17 · owasp-modsecurity/ModSecurity

Major changes in v3: [fix: t:htmlEntityDecode does not decode all ASCII named HTML entities] [PR from private repo - @marcstern, @fzipi, @airween; fixed GHSA-cxqf-vgrr-xxrv] [fix: use secure value...

github.com
2
7
237
Hi guys, we are pleased to present the revamped modsecurity.org website!

ModSecurity Project – Open-Source Web Application Firewall

ModSecurity helps protect your sites and apps with an OWASP-backed open-source WAF. Flexible rules, active community, trusted by developers.

modsecurity.org
1
5
459
Replying to @hacker_infra
Awesome - please update your package: xitter.cf/ModSecurity/status/207…
ModSecurity@ModSecurityJun 29
A new version of libmodsecurity3 has been released, please check the blog post and update your library: modsecurity.org/20260629/abo…

About CVE-2026-52747 and 2026-52761

We would like to share our take on CVE-2026-52747 and CVE-2026-52761, which were published on June 29, 2026.

modsecurity.org
1
A new version of libmodsecurity3 has been released, please check the blog post and update your library: modsecurity.org/20260629/abo…

About CVE-2026-52747 and 2026-52761

We would like to share our take on CVE-2026-52747 and CVE-2026-52761, which were published on June 29, 2026.

modsecurity.org
1
2
583
"How big is too big" - a new blog post has been published on modsecurity.org - enjoy reading! modsecurity.org/20260222/how…

ModSecurity Project – Open-Source Web Application Firewall

ModSecurity helps protect your sites and apps with an OWASP-backed open-source WAF. Flexible rules, active community, trusted by developers.

modsecurity.org
2
4
488
Replying to @HackerVault
Probably there is a typo here (see the image): there is no such operator ">=". Perhaps you though "@gt".
59
CRS will have its second community call on September 22, from 20:30 to 21:30 CEST (18:30 UTC / 2:30 p.m. ET) and will be moderated by former CRS co-leader Christian Folini. Check more details and register here: luma.com/8yc1p543

CRS Community Call · Luma

A video call where the CRS dev team gets to meet their community face-to-face. A place for information exchange and questions for both newbies and experienced…

luma.com
4
7
2,430
Replying to @rad_tech_mx
Yes 🙂
29
A new version of mod_security2 has been released, please check the blog post: modsecurity.org/20250805/imp…

Improper error handling: CVE-2025-54571 - 2025 August

We would like to share our take on CVE-2025-54571, which was published on August 5, 2025.

modsecurity.org
1
209
A new version of mod_security2 has been released, please check the blog post: modsecurity.org/20250701/dos…

DoS vulnerability: CVE-2025-52891 - 2025 July

We would like to share our take on CVE-2025-52891, which was published on July 1, 2025.

modsecurity.org
2
261
Replying to @idr00t
We don't know how old is this article, but please update it. There is a much newer version than 2.9.7 (2.9.10 is the last release).
1
52
Replying to @_0b1d1
With CRS, ModSecurity catches this attack on PL1. $ curl -X POST -d 'q=<a href="jav%0Dascript&colon;alert(1)">' -H "x-format-output: txt-matched-rules" sandbox.coreruleset.org/ Output: 941390 PL1 Javascript method detected 949110 PL1 Inbound Anomaly ... 980170 PL1 Anomaly Sco...
1
156
Replying to @iototsecnews
"No Patch" - you misinform your users. The patch was applied earlier than the advisory was published. Please take a look at our GH page.
2
77
New version of mod_security2 have been released:  github.com/owasp-modsecurity… This versions includes a fix against a recently discovered (another) DoS vulnerability: modsecurity.org/20250602/dos… Please upgrade your module!
2
209
Replying to @cayahuanca_
Why is difficult? Feel free to ask on Github or on Slack: owasp.org/slack/invite, channel "project-modsecurity"

Join OWASP on Slack | OWASP Foundation

Join the OWASP Slack workspace to connect with chapters, project leaders, and security professionals around the world. Slack is the hub for community discussion, announcements, and collaboration.

owasp.org
1
27
New version has been released: Nginx connector: github.com/owasp-modsecurity… blog post: modsecurity.org/20250521/mod… Please note that the log format has been changed!
2
191
New version have been released: mod_security2:  github.com/owasp-modsecurity… This versions includes a fix against a recently discovered DoS vulnerability: modsecurity.org/20250521/pos… Please upgrade your module!
1
149
Happy to announce OWASP Open WAF Day: owasp2025globalappseceu.sche… Feel free to register yourself! #modsecurity #coreruleset #crs #coraza #waf

OWASP 2025 Global AppSec EU: Open WAF Day | CRS & ModSecurity & Coraz...

View more about this event at OWASP 2025 Global AppSec EU

owasp2025globalappseceu.sched.com
2
515
Please take a look at this issue and share your opinions (on GH): github.com/owasp-modsecurity…

Remove possiblity to disable early-blocking processing · Issue #3362 · owasp-modsecurity/ModSecurity

The compile-time option --disable-request-early in ModSecurity 2.x can lead to incorrect request processing with Core Rule Set (CRS) 4.0 and higher (as highlighted here). Given that CRS 4.0+ relies...

github.com
2
272
Replying to @cjihrig
There are several ways. - join to our Slack community: owasp.org/slack/invite, check "# project-modsecurity" channel - send any pull request on GH - you can reach us in e-mail: modsecurity at owasp dot org

Join OWASP on Slack | OWASP Foundation

Join the OWASP Slack workspace to connect with chapters, project leaders, and security professionals around the world. Slack is the hub for community discussion, announcements, and collaboration.

owasp.org
1
1
43
Load more