CVE-2020-15598
CVE-2020-15598 is a high-severity vulnerability in Owasp Modsecurity with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-835.
Key facts
- Severity: High (CVSS 3.x base score 7.5)
- CVSS v2: 5.0
- EPSS exploit prediction: 3% (87th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-835
- Affected product: Owasp Modsecurity
- Published:
- Last modified:
Description
Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial of Service condition. The vendor does not consider this as a security issue because1) there is no default configuration issue here. An attacker would need to know that a rule using a potentially problematic regular expression was in place, 2) the attacker would need to know the basic nature of the regular expression itself to exploit any resource issues. It's well known that regular expression usage can be taxing on system resources regardless of the use case. It is up to the administrator to decide on when it is appropriate to trade resources for potential security benefit
Frequently asked questions
- What is CVE-2020-15598?
- Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial of Service condition. The vendor does not consider this as a security issue because1) there is no default configuration issue here. An attacker would need to know that a rule using a potentially problematic regular expression was in place, 2) the attacker would need to know the basic nature of the regular expression itself to exploit any resource issues. It's well known that regular expression usage can be taxing on system resources regardless of the use case. It is up to the administrator to decide on when it is appropriate to trade resources for potential security benefit
- How severe is CVE-2020-15598?
- CVE-2020-15598 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2020-15598 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (87th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2020-15598?
- CVE-2020-15598 primarily affects Owasp Modsecurity. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2020-15598?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2020-15598 published?
- CVE-2020-15598 was published on 2020-10-06 and last updated on 2026-06-17.
References
- http://packetstormsecurity.com/files/159185/ModSecurity-3.0.x-Denial-Of-Service.html
- http://seclists.org/fulldisclosure/2020/Sep/32
- https://coreruleset.org/20200914/cve-2020-15598/
- https://www.debian.org/security/2020/dsa-4765
- https://www.modsecurity.org
Affected products (2)
- cpe:2.3:a:owasp:modsecurity:*:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
More vulnerabilities in Owasp Modsecurity
- CVE-2024-1019 — High (CVSS 8.6): ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via…
- CVE-2026-42268 — High (CVSS 7.5): ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From…
- CVE-2026-30923 — High (CVSS 7.5): ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.…
- CVE-2025-48866 — High (CVSS 7.5): ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions…
- CVE-2023-38285 — High (CVSS 7.5): Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity.
- CVE-2023-28882 — High (CVSS 7.5): Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness)…
All CVEs affecting Owasp Modsecurity →
Other CWE-835 (Loop with Unreachable Exit Condition (Infinite Loop)) vulnerabilities
- CVE-2026-24816 — Critical (CVSS 10.0): Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in datavane tis…
- CVE-2018-20784 — Critical (CVSS 9.8): In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a…
- CVE-2017-12997 — Critical (CVSS 9.8): The LLDP parser in tcpdump before 4.9.2 could enter an infinite loop due to a bug in…
- CVE-2017-12995 — Critical (CVSS 9.8): The DNS parser in tcpdump before 4.9.2 could enter an infinite loop due to a bug in print-domain.c:ns_print().
- CVE-2017-12990 — Critical (CVSS 9.8): The ISAKMP parser in tcpdump before 4.9.2 could enter an infinite loop due to bugs in print-isakmp.c, several functions.
- CVE-2026-31448 — Critical (CVSS 9.4): In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual…
Browse all CWE-835 (Loop with Unreachable Exit Condition (Infinite Loop)) vulnerabilities →