owasp-modsecurity/ModSecurity

View on GitHub

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.

Stars: 9.8k
Forks: 1.8k
Open beginner issues: 0
Indexed issues: 265
Avg merge: 2h 46m
Merged PRs (30d): 1

Dominant language: C++
License: Apache-2.0
Last GitHub push: Jun 29, 2026
Latest indexed: Sep 20, 2026
Contributing guide: No contributing guide
Code of conduct: No code of conduct
Beginner labels: help wanted

Beginner friendly Everything

Open All

265 open issues indexed

Encountering SIGSEGV when parsing multiple rule sets in parallel Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3138 · 5 comments · Opened May 10, 2024
Update link on Reference Manual v3 wiki page Open

3.x

owasp-modsecurity/ModSecurity#3136 · 3 comments · 1 assignee · Opened May 5, 2024
[Idea] Add variable support for SecAuditLog Open

new feature

Difficulty 5/5 Over a week Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3133 · 3 comments · Opened Apr 25, 2024
@rbl operator does not support IPv6 Open

:1st_place_medal: good first issue 2.x 3.x bug duplicate

owasp-modsecurity/ModSecurity#3131 · 1 comment · 1 assignee · Opened Apr 24, 2024
Incorrect utf8toUnicode transformation for 00xx Open

2.x

Difficulty 3/5 1-2 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3129 · 3 comments · Opened Apr 23, 2024
Regular Expression Failure Triggers `!@rx` Open

3.x bug

owasp-modsecurity/ModSecurity#3123 · 6 comments · 1 assignee · Opened Apr 19, 2024
Feature request: Limit the number of rules processed per request Open

2.x

Difficulty 5/5 Over a week Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3112 · 3 comments · Opened Mar 25, 2024
libmodsecurity3: Request body is not logged Open

3.x bug

owasp-modsecurity/ModSecurity#3109 · 10 comments · 1 assignee · Opened Mar 19, 2024
SecRuleScript actions always considered disruptive Open

3.x bug

owasp-modsecurity/ModSecurity#3108 · 1 comment · 1 reaction · 3 assignees · Opened Mar 16, 2024
Debian package dependencies are broken Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3102 · 10 comments · Opened Mar 5, 2024
SecAuditLogFormat set to JSON prints logs in native format aswell Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3100 · 8 comments · Opened Mar 1, 2024
SanitiseArg does not work in RequestBody Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3089 · 6 comments · Opened Feb 21, 2024
Problem with logfile's name Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3084 · 4 comments · Opened Feb 15, 2024
No CPE for 3.0.11 and 3.0.12 Open

2.x 3.x

Difficulty 5/5 Over a week Newbie friendliness 20/100

owasp-modsecurity/ModSecurity#3083 · 4 comments · Opened Feb 14, 2024
Different behavior of the engines implicit `@rx` operator Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

owasp-modsecurity/ModSecurity#3081 · 11 comments · Opened Feb 11, 2024
Inadequate locking for multithreading in libModSecurity In-Memory persistent storage Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3054 · 6 comments · Opened Feb 7, 2024
libmodsecurity3: SecAction can't be disabled via ctl action Open

3.x bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

owasp-modsecurity/ModSecurity#3053 · 3 comments · Opened Feb 6, 2024
Problem with logrotate: Log rotation writes to incorrect file Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3047 · 2 comments · Opened Jan 30, 2024
Update Wikipedia:ModSecurity Open

admin (OWASP transfer)

Difficulty 2/5 1-3 hours Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3046 · Opened Jan 29, 2024
Review and update security.md Open

admin (OWASP transfer)

Difficulty 3/5 1-2 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3045 · 1 comment · Opened Jan 28, 2024
Review all repositories under owasp-modsecurity org and retire the ones no longer needed Open

admin (OWASP transfer)

Difficulty 5/5 Over a week Newbie friendliness 20/100

owasp-modsecurity/ModSecurity#3044 · Opened Jan 28, 2024
Regex key non-matches with libModSecurity persistent storage Open

3.x bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3039 · 1 comment · Opened Jan 26, 2024
Concurrent log index files do not respect SecAuditLogRelevantStatus Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3038 · Opened Jan 26, 2024
lua script can not access XML variable Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3037 · Opened Jan 22, 2024
Feature: Can we have a basic benchmark report graph in the README Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

owasp-modsecurity/ModSecurity#3036 · Opened Jan 17, 2024
lua m.log(2, "4444") where is the log message? Open

Platform - Nginx

Difficulty 4/5 3-5 days Newbie friendliness 30/100

owasp-modsecurity/ModSecurity#3035 · Opened Jan 15, 2024
SecRequestBodyAccess Off is still loading request body in memory Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3022 · 3 comments · Opened Dec 4, 2023
Performance enhancement calling expand_macros() Open

2.x enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3010 · 1 comment · Opened Oct 31, 2023
408 http code generated by mod_reqtimeout is not detected Open

2.x Platform - Apache

Difficulty 4/5 3-5 days Newbie friendliness 48/100

owasp-modsecurity/ModSecurity#3007 · 17 comments · Opened Oct 30, 2023
IIS multiple response headers with the same name Open

Platform - IIS

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#2991 · 7 comments · Opened Oct 2, 2023
PCRE2 performance Open

2.x help wanted Platform - Apache

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#2972 · 5 comments · Opened Aug 24, 2023
verifySSN: Area code can be larger than 740 Open

Difficulty 2/5 1-3 hours Newbie friendliness 55/100

owasp-modsecurity/ModSecurity#2970 · 2 comments · Opened Aug 21, 2023
Cross-Compatible JSON Body Exclusion Ruleset for Different ModSecurity Versions Open

2.x 3.x

Difficulty 5/5 Over a week Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#2942 · 2 comments · 2 reactions · Opened Aug 10, 2023
Target transformed even when ignored via ctl: action Open

2.x bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#2932 · 2 comments · Opened Jul 20, 2023
SecRuleUpdateActionById may not replace non-disruptive, non-additive actions Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 38/100

owasp-modsecurity/ModSecurity#2928 · Opened Jul 12, 2023
Regex in setvar variables Open

2.x enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#2927 · 4 comments · Opened Jul 12, 2023
AuditLog JSON large data field Open

3.x Platform - Nginx

Difficulty 4/5 3-5 days Newbie friendliness 30/100

owasp-modsecurity/ModSecurity#2925 · 2 comments · Opened Jul 11, 2023
NEW FEATURE: GraphQL Security Open

new feature

Difficulty 5/5 Over a week Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#2919 · 1 comment · Opened Jun 27, 2023
@ipMatch misses IP with multiple values Open

2.x bug Platform - Apache

Difficulty 3/5 1-2 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#2893 · 16 comments · Opened Apr 20, 2023
ModSecurity not finding SecMarker in phase 2 Open

2.x bug Platform - Apache

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#2865 · 12 comments · Opened Jan 20, 2023
DOC: `SecRuleUpdateActionById` and `chain` docs are errant for both 2.x and 3.x Open

2.x 3.x documentation

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#2860 · 1 comment · Opened Jan 12, 2023
Apache httpd does not execute ErrorDocument directive if response code is changed during phase 4 Open

2.x bug Platform - Apache

Difficulty 4/5 3-5 days Newbie friendliness 48/100

owasp-modsecurity/ModSecurity#2849 · Opened Dec 22, 2022
Memory leaks with nginx reload (without restart) Open

3.x Platform - Nginx

Difficulty 4/5 3-5 days Newbie friendliness 30/100

owasp-modsecurity/ModSecurity#2848 · 32 comments · 1 reaction · Opened Dec 21, 2022
ModSecurity can cause hang of apache httpd during graceful restart Open

2.x Platform - Apache

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#2822 · Opened Oct 20, 2022
Transaction intializing twice per request for URI '/' Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 30/100

owasp-modsecurity/ModSecurity#2816 · 9 comments · Opened Oct 13, 2022
Bug: Premature EOF in JSON leads to status 500 instead of REQBODY_ERROR Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#2807 · 10 comments · Opened Oct 5, 2022
Handle strange Windows usernames Open

2.x Platform - IIS

Difficulty 1/5 Under an hour Newbie friendliness 45/100

owasp-modsecurity/ModSecurity#2798 · 2 comments · Opened Sep 7, 2022
Sanitize XML (same as #360 and #587) Open

2.x new feature

Difficulty 5/5 Over a week Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#2779 · 1 comment · Opened Aug 3, 2022
Repeated headers cause problems in json audit logs Open

3.x

Difficulty 5/5 Over a week Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#2777 · 1 comment · Opened Jul 26, 2022
configure with --with-lua= / parameter seems to be not used Open

3.x

Difficulty 3/5 1-2 days Newbie friendliness 38/100

owasp-modsecurity/ModSecurity#2773 · 2 comments · Opened Jul 15, 2022

owasp-modsecurity/ModSecurity

Get new issues in your inbox