ModSecurity v3.8.1 Security Update: Fix for JSON Nested Stack Overflow Crash and Multiple GHSA Remediations

Vulnerability Overview Vulnerability Name: GHSA-6qcz-w295-5xf2 Severity: High Description: Deeply nested JSON request or response bodies can cause process crashes (unrecoverable stack overflow). JSON nesting is now limited via iterative pre-scanning before validation (ADR-0060). Impact Scope Affected Versions: v3.8.0 and earlier Specific Impact: Deeply nested JSON request or response bodies can cause process crashes. Fix Fixed Version: v3.8.1 Remediation: Iterative pre-scanning is applied to limit JSON nesting before validation. Other Security Fixes GHSA-6r3q-mj7-x8m: Completed v3.8.0 fix; JSON array length entries are now limited within the flattened byte budget, closing the memory exhaustion vector. GHSA-5qjd-9qm7-2fx2: Completed v3.8.0 fix; JSON keys that differ only in or no longer overwrite each other. GHSA-w253-m66g-x24: Completed v3.8.0 fix; leading spaces in media types are trimmed only when the header selects the body processor, matching the behavior of . GHSA-3w77-993q-jrff: Completed v3.8.0 fix; RFC 2231 continuations now set . Also fixed a CPU exhaustion vector in the duplicate parameter check, which was introduced in v3.8.0. GHSA-4qgm-m288-5cp9: Completed v3.8.0 fix; cookies with empty names or containing only control characters are now checked under the key instead of being discarded. The regex exclusion no longer removes entries with the key from , , or any other collection. Behavior Changes JSON bodies over the flattening memory budget: Now sets , causing rule 200002 to reject them with a 400 status. Previously, they were truncated. Empty cookie names: and can now contain entries named (e.g., from ), counted in . This is an intentional deviation: ModSecurity v2 and v3 skip such cookies, but some backends (such as Node's package) pass them to the application. Empty values are still skipped. Regex : no longer removes entries named unless the regular expression matches an empty string. JSON array-length entries: The length of arrays no longer counts towards . coraza.conf-recommended: is now explicitly set; it was previously commented out. The limit applies per source ( , , ). Commented-out examples no longer reuse rule IDs 200004 and 200005. Important Notes Running rules 200004 and 200005 with non-recommended configurations? defaults to 1000, even if not set. Since v3.8.0, parameters exceeding this limit (from query strings and URL-encoded or JSON bodies) are dropped from the tail, and only is set. Rules without action flags (such as CRS) do not check these parameters. Add rules 200004 and 200005 from or equivalent rules triggered on . Changes from v3.7.x SecArgumentsLimit: The default of 1000 now also applies to URL-encoded and JSON request bodies. Requests exceeding the limit are rejected by rules 200004/200005. Increase the limit if your API legally requires more values. New rule 200009: In , returns 400 for unparsable URIs: invalid path escapes ( , ), bad paths, or missing leading . URLREMOVED_ERROR: No longer set when the request URL is unparsable. Uses the new variable; rule 200009 depends on this. Rule 200003: Now returns 400 for multipart sections with malformed or duplicate headers, previously hiding uploaded files from rule checks. Only sections containing now go to instead of . New method: : Breaks external implementations at compile time. New types/variables: Constants are inserted in the middle, requiring renumbering afterwards. Full Changelog v3.8.0...v3.8.1 Contributors fzpi MatteoP

Goal Reached Thanks to every supporter — we hit 100%!

ModSecurity v3.8.1 Security Update: Fix for JSON Nested Stack Overflow Crash and Multiple GHSA Remediations

More from this source