PT-2020-10284 · Trustwave · Modsecurity

Airween + 3 · Published 2020-01-21 · Updated 2025-07-03 · CVE-2019-19886

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Trustwave ModSecurity versions 3.0.0 through 3.0.3

Description The issue allows an attacker to send crafted requests that may lead to the server becoming slow or unresponsive due to a flaw in Transaction::addRequestHeader in transaction.cc. This can cause a Denial of Service when sent quickly in large volumes.

Recommendations For Trustwave ModSecurity versions 3.0.0 through 3.0.3, update to a version outside of this range to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2019-19886

Affected Products

Modsecurity

References · 25

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWVUC54OPU7ICFYIXXVGQ5DOTMR4Z6ZY · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-19886 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19886 · Security Note
• https://trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-denial-of-service-details-cve-2019-19886 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19886 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19886 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19886 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JI3MNFRNUZD6RAJ5CPQZSUXQXDZ2K7IL · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-19886 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7IIUNYIEZOWHRWWRVT3FR45MLE6HGDY · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-19886 · Vendor Advisory
• https://github.com/SpiderLabs/ModSecurity/commit/7ba77631f9a37e0680d23ee57c455c6a35c65cb9 · Note
• https://github.com/SpiderLabs/ModSecurity/pull/2202 · Note
• https://t.me/rnetsec/11561 · Telegram Post
• https://t.me/defcon_news/38503 · Telegram Post