owasp-modsecurity/ModSecurity

View on GitHub

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.

Stars: 9.8k
Forks: 1.8k
Open beginner issues: 0
Indexed issues: 265
Avg merge: 2h 46m
Merged PRs (30d): 1

Dominant language: C++
License: Apache-2.0
Last GitHub push: Jun 29, 2026
Latest indexed: Sep 20, 2026
Contributing guide: No contributing guide
Code of conduct: No code of conduct
Beginner labels: help wanted

Beginner friendly Everything

Open All

5 beginner-friendly issues open

IIS: ReadFileChunk allocates only 1 byte but reads m_dwPageSize (latent overflow) Open

2.x Platform - IIS

Difficulty 1/5 Under an hour Newbie friendliness 90/100

owasp-modsecurity/ModSecurity#3623 · 1 comment · Opened Aug 27, 2026
IIS: Host header fallback is dead code (r->hostname == NULL can never be true) Open

2.x Platform - IIS

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

owasp-modsecurity/ModSecurity#3621 · 1 comment · Opened Aug 27, 2026
IIS: Content-Length header corrupted/truncated for large responses (wrong printf format + off-by-one buffer size) Open

2.x Platform - IIS

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

owasp-modsecurity/ModSecurity#3619 · 1 comment · Opened Aug 27, 2026
IIS connector: audit log F part always shows '500 Internal Server Error' for normal traffic Open

2.x Platform - IIS

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

owasp-modsecurity/ModSecurity#3612 · 1 comment · Opened Aug 14, 2026
SecUploadFileMode parsed as decimal instead of octal; temp files have no read permission Open

3.x

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

owasp-modsecurity/ModSecurity#3580 · 1 comment · Opened Jun 17, 2026

owasp-modsecurity/ModSecurity

Get new issues in your inbox