Owner

owasp-modsecurity

3 indexed repositories · View on GitHub

ModSecurity
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-base...

C++ · 9782 stars
ModSecurity-nginx
ModSecurity v3 Nginx Connector

Perl · 1856 stars
secrules-language-tests
Set of test cases that can be used to test custom implementations of the SecRules language (ModSecurity rules format).

Perl · 16 stars

Beginner friendly Everything

Open All

IIS: IPv6 link-local client addresses break IP matching ("IPmatch: bad IPv6 specification") Open

2.x Platform - IIS

Difficulty 2/5 1-3 hours Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3630 · Opened Sep 17, 2026
IIS: ReadFileChunk allocates only 1 byte but reads m_dwPageSize (latent overflow) Open

2.x Platform - IIS

Difficulty 1/5 Under an hour Newbie friendliness 90/100

owasp-modsecurity/ModSecurity#3623 · 1 comment · Opened Aug 27, 2026
IIS: Host header fallback is dead code (r->hostname == NULL can never be true) Open

2.x Platform - IIS

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

owasp-modsecurity/ModSecurity#3621 · 1 comment · Opened Aug 27, 2026
IIS: Content-Length header corrupted/truncated for large responses (wrong printf format + off-by-one buffer size) Open

2.x Platform - IIS

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

owasp-modsecurity/ModSecurity#3619 · 1 comment · Opened Aug 27, 2026
IIS connector: audit log F part always shows '500 Internal Server Error' for normal traffic Open

2.x Platform - IIS

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

owasp-modsecurity/ModSecurity#3612 · 1 comment · Opened Aug 14, 2026
multipart C-T header validation - false positive (rule id 200002, Multiple boundary parameters) Open

3.x bug

Difficulty 3/5 1-2 days Newbie friendliness 68/100

owasp-modsecurity/ModSecurity#3610 · 3 comments · Opened Aug 13, 2026
libModSecurity3: REQUEST_HEADERS names are treated as case sensitive with configure-time rule-exclusions Open

:1st_place_medal: good first issue 3.x

Difficulty 3/5 1-2 days Newbie friendliness 64/100

owasp-modsecurity/ModSecurity#3609 · 2 comments · Opened Aug 7, 2026
Windows CI: flaky pcre2/zlib/openssl tarball download in test_new.yml's build-windows job Open

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

owasp-modsecurity/ModSecurity-nginx#388 · Opened Jul 28, 2026
Windows build fails: yajl's Conan recipe sets CMP0026 OLD, incompatible with newer CMake Open

3.x windows

Difficulty 4/5 3-5 days Newbie friendliness 52/100

owasp-modsecurity/ModSecurity#3604 · 2 comments · Opened Jul 28, 2026
Partial Log Forging in RuleMessage::log() via Unescaped Quote Characters in Request-Derived Fields Open

3.x

Difficulty 3/5 1-2 days Newbie friendliness 75/100

owasp-modsecurity/ModSecurity#3601 · 3 comments · Opened Jul 20, 2026
x86 IIS module in CI-built MSI fails to load - fuzzy.dll missing MinGW runtime DLLs (error 126) Open

2.x

Difficulty 3/5 1-2 days Newbie friendliness 72/100

owasp-modsecurity/ModSecurity#3599 · 1 comment · Opened Jul 17, 2026
Module logs version of libmodsecurity headers it was built against, not dynamically linked version Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

owasp-modsecurity/ModSecurity-nginx#383 · 1 comment · Opened Jun 29, 2026
GnuTLS after many apache reloads Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 48/100

owasp-modsecurity/ModSecurity#3590 · 9 comments · Opened Jun 29, 2026
@ipMatchFromFile and @ipMatch code (same code in v2 & v3) becomes buggy from a certain number of IP. Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 42/100

owasp-modsecurity/ModSecurity#3588 · 3 comments · Opened Jun 28, 2026
ModSecurity POST: SQLi bypass via request-body predicate/operator rewrites Open

3.x

Difficulty 5/5 Over a week Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3587 · 1 comment · Opened Jun 27, 2026
ModSecurity GET(JSON): SQLi bypass via separator, literal, and annotation variants Open

Difficulty 5/5 Over a week Newbie friendliness 28/100

owasp-modsecurity/ModSecurity#3586 · 1 comment · Opened Jun 27, 2026
ModSecurity GET: SQLi bypass via scalar-expression and operator rewrites Open

3.x

Difficulty 5/5 Over a week Newbie friendliness 42/100

owasp-modsecurity/ModSecurity#3585 · 2 comments · Opened Jun 27, 2026
Fix Failing to Match IPv6 Addresses@ipMatchFromFile Open

3.x

Difficulty 3/5 1-2 days Newbie friendliness 48/100

owasp-modsecurity/ModSecurity#3584 · 8 comments · Opened Jun 27, 2026
Apache-Error: [file "apache2_util.c"] [line 275] [level 3] ModSecurity: JSON parsing error: lexical error: invalid char in json text. Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3581 · 3 comments · Opened Jun 19, 2026
SecUploadFileMode parsed as decimal instead of octal; temp files have no read permission Open

3.x

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

owasp-modsecurity/ModSecurity#3580 · 1 comment · Opened Jun 17, 2026
wiki: Remove deprecated REQBODY_PROCESSOR_ERROR and REQBODY_PROCESSOR_ERROR_MSG from wiki pages Open

2.x

Difficulty 2/5 1-3 hours Newbie friendliness 48/100

owasp-modsecurity/ModSecurity#3576 · 9 comments · Opened Jun 16, 2026
Ubuntu nginx 1.24.0-2ubuntu7.10 crashes workers with ngx_http_modsecurity_module enabled; 1.24.0-2ubuntu7.9 works Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 55/100

owasp-modsecurity/ModSecurity#3572 · 3 comments · 2 reactions · Opened Jun 9, 2026
Audit log match does not represent chained rules Open

3.x duplicate

Difficulty 4/5 3-5 days Newbie friendliness 48/100

owasp-modsecurity/ModSecurity#3569 · 1 comment · Opened May 19, 2026
REQBODY_ERROR "Extra content at the end of the document" after 3.0.15 update Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 38/100

owasp-modsecurity/ModSecurity#3563 · 11 comments · Opened May 13, 2026
Hit rule and record request_body log. Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 42/100

owasp-modsecurity/ModSecurity#3561 · 3 comments · Opened May 11, 2026
Exclude .gitignore files from release tarballs Open

3.x

Difficulty 3/5 1-2 days Newbie friendliness 48/100

owasp-modsecurity/ModSecurity#3559 · 6 comments · Opened May 8, 2026
Log message should indicate if operator is negative Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

owasp-modsecurity/ModSecurity#3554 · 1 comment · Opened May 2, 2026
Intermittent nginx startup failure on modsecurity_rules_remote with libnginx-mod-http-modsecurity 1.0.3 / libmodsecurity 3.0.12 on Ubuntu Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity-nginx#375 · 2 comments · Opened Apr 23, 2026
Remove code specific to Internet Explorer Open

2.x 3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3549 · 2 comments · Opened Apr 20, 2026
Potential regex compilation failure or mismatch with variable-length lookbehind in PCRE patterns Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 48/100

owasp-modsecurity/ModSecurity#3537 · 2 comments · Opened Apr 7, 2026
Add performance audit document for ModSecurity v3 Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3536 · Opened Apr 5, 2026
Feature Request: Wildcard/pattern support in ctl:ruleRemoveTargetById (v3) Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 48/100

owasp-modsecurity/ModSecurity#3505 · 7 comments · 2 reactions · Opened Feb 28, 2026
Feature Request: Add `ARGS_RAW`, `ARGS_GET_RAW`, `ARGS_POST_RAW`, and `ARGS_NAMES_RAW` Variables Open

new feature

Difficulty 5/5 Over a week Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3501 · 4 comments · Opened Feb 18, 2026
Unecessar escaped quote mark in JSON logs Open

Difficulty 3/5 1-2 days Newbie friendliness 55/100

owasp-modsecurity/ModSecurity-nginx#365 · 2 comments · Opened Dec 8, 2025
Inconsistent Error Log Format of ModSecurity depending on Apache's ErrorLogFormat directive Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3472 · 7 comments · Opened Dec 2, 2025
AFL fuzzer reports Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3469 · 3 comments · Opened Nov 21, 2025
Variable needed : REQUEST_HAS_BODY to avoid content-type evasion Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3466 · 3 comments · Opened Nov 20, 2025
No "real" capture of HTTP:BL response Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3465 · 8 comments · Opened Nov 14, 2025
Wrong http_code in modsec logs when using auth_request Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

owasp-modsecurity/ModSecurity-nginx#363 · 13 comments · Opened Nov 11, 2025
2.x standalone fails to link since ap_map_http_request_error() is not exported as APR function Open

2.x

Difficulty 3/5 1-2 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3451 · 2 comments · Opened Oct 22, 2025
Question: how is setenv supposed to work in ModSecurity 3.0.x Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3449 · 3 comments · Opened Oct 17, 2025
ModSecurity v2.9.12 “Skipping request since there is nowhere to write to” despite valid SecAuditLog configuration Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 45/100

owasp-modsecurity/ModSecurity#3446 · 10 comments · Opened Oct 15, 2025
Basic modsecurity setup with nginx docker image responds with HTML content but with content-type of text/plain Open

Difficulty 3/5 1-2 days Newbie friendliness 55/100

owasp-modsecurity/ModSecurity-nginx#362 · 2 comments · Opened Sep 30, 2025
2.9.12 installer Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

owasp-modsecurity/ModSecurity#3440 · 2 comments · Opened Sep 5, 2025
Stack overflow in pcre.dll Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3436 · 10 comments · Opened Aug 22, 2025
Recommended rule 200005 misses MSC_PCRE_LIMITS_EXCEEDED in phase 2 Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3415 · 2 comments · 1 reaction · Opened Jul 9, 2025
Possible dereference of Null Open

:1st_place_medal: good first issue enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

owasp-modsecurity/ModSecurity-nginx#359 · 3 comments · Opened Jul 8, 2025
High RAM Usage with Concurrent Logging Mode in ModSecurity Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3414 · 8 comments · Opened Jul 7, 2025
request on iis with more than 999 characters single value in cookie are getting blocked and no specific rule to fix Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3413 · 1 comment · Opened Jul 6, 2025
Performance issues with ModSecurity2/Alpine/PCRE2 Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3409 · 5 comments · 1 reaction · Opened Jun 23, 2025

Showing the newest 100

This page lists what was indexed most recently. Advanced filter has the whole inventory, narrowed by language, difficulty and how long a task takes.

Open advanced filter

owasp-modsecurity

Showing the newest 100

Get new issues in your inbox