Vulnerability · Published Oct 9, 2024 · Assigned by mitre
CVE-2024-46292
High 7.5
In plain English
A high-severity buffer overflow in the modsecurity package (Ubuntu). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Official description
A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name parameter. NOTE: this is disputed by the Supplier because it cannot be reproduced. Also, the product's documentation indicates that it is not guaranteed to be usable with very large values of SecRequestBodyNoFilesLimit (which are required by the claimed issue).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | modsecurity | no fix listed | UBUNTU-CVE-2024-46292 |
| Ubuntu:24.04:LTS | modsecurity | no fix listed | UBUNTU-CVE-2024-46292 |
| Ubuntu:25.10 | modsecurity | no fix listed | UBUNTU-CVE-2024-46292 |
| Ubuntu:26.04:LTS | modsecurity | no fix listed | UBUNTU-CVE-2024-46292 |
| Ubuntu:26.10 | modsecurity | no fix listed | UBUNTU-CVE-2024-46292 |
Affected products (as reported)
Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H