owasp-modsecurity/ModSecurity

View on GitHub

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.

Stars: 9.8k
Forks: 1.8k
Open beginner issues: 0
Indexed issues: 265
Avg merge: 2h 46m
Merged PRs (30d): 1

Dominant language: C++
License: Apache-2.0
Last GitHub push: Jun 29, 2026
Latest indexed: Sep 20, 2026
Contributing guide: No contributing guide
Code of conduct: No code of conduct
Beginner labels: help wanted

Beginner friendly Everything

Open All

265 open issues indexed

Configuration directive SecUploadFileLimit is exclusive Open

3.x

Difficulty 3/5 1-2 days Newbie friendliness 38/100

owasp-modsecurity/ModSecurity#2766 · 3 comments · Opened Jun 20, 2022
feature request: show action payload in debug log, like ctl:xxxx Open

Difficulty 2/5 1-3 hours Newbie friendliness 48/100

owasp-modsecurity/ModSecurity#2729 · 1 comment · Opened Apr 25, 2022
Cannot get REQUEST_FILENAME with %3f (encoded ?) in url path Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#2705 · 11 comments · Opened Mar 19, 2022
feature request: cache transformed value Open

new feature

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#2702 · 4 comments · Opened Mar 16, 2022
Unable to turn off writing to the server log even set to `nolog,noauditlog` Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#2698 · 7 comments · Opened Mar 14, 2022
SecAuditLogParts never logs anything for 'K' type (list of rule IDs) Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#2684 · 3 comments · Opened Feb 18, 2022
Rules with both chain and multiMatch may produce excess writes to audit log Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#2672 · 1 comment · Opened Jan 14, 2022
ModSecurity should able to analyse gRPC request body. Open

new feature

Difficulty 5/5 Over a week Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#2645 · 5 comments · 2 reactions · Opened Nov 22, 2021
Modsecurity sees the HTTP "INVALID" method instead of "PATCH" Open

2.x Platform - IIS

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#2623 · 3 comments · Opened Sep 26, 2021
build broken on Debian bullseye - ../libtool: line 1733: 84059 Aborted (core dumped) ar cr .libs/libmodsecurity.a Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#2613 · 11 comments · Opened Sep 1, 2021
Compile Modsecurity v3.x for WASM architecture Open

3.x

owasp-modsecurity/ModSecurity#2590 · 9 comments · 1 assignee · Opened Jul 9, 2021
XML: there is no way to obtain actual error message from libxml2 on parsing failures Open

3.x enhancement

Difficulty 4/5 3-5 days Newbie friendliness 45/100

owasp-modsecurity/ModSecurity#2565 · Opened May 5, 2021
Are there any plans to create the Reference Manual for 3.x? Open

3.x

owasp-modsecurity/ModSecurity#2563 · 2 comments · 3 reactions · 1 assignee · Opened May 3, 2021
Can I use m.getvar("RULE.id") to get the current rule id in 3.x version? Open

3.x workaround available

owasp-modsecurity/ModSecurity#2527 · 4 comments · 1 assignee · Opened Mar 4, 2021
Only the last match of a rule is logged Open

3.x

owasp-modsecurity/ModSecurity#2512 · 4 comments · 1 assignee · Opened Feb 11, 2021
[Feature request] Offset support for SecRuleUpdateTargetById Open

3.x enhancement

owasp-modsecurity/ModSecurity#2508 · 1 comment · 1 reaction · 1 assignee · Opened Jan 27, 2021
allow logging to systemd journal Open

3.x enhancement

owasp-modsecurity/ModSecurity#2506 · 6 comments · 1 assignee · Opened Jan 24, 2021
Problems with blocking if response is using compression Open

2.x Platform - Apache

owasp-modsecurity/ModSecurity#2494 · 27 comments · 1 assignee · Opened Jan 6, 2021
ModSecurity 3 - Windows Apache/Nginx Connector Open

3.x

owasp-modsecurity/ModSecurity#2480 · 8 comments · 1 reaction · 1 assignee · Opened Dec 18, 2020
Change SecRuleRemoveByMsg behaviour to looking of substring Open

3.x enhancement

owasp-modsecurity/ModSecurity#2476 · 3 reactions · 2 assignees · Opened Dec 15, 2020
sanitiseMatchedBytes only works with 1 digit parameters Open

2.x enhancement

owasp-modsecurity/ModSecurity#2472 · 5 comments · 1 assignee · Opened Dec 8, 2020
SecRequestBodyAccess off skips the phase:2 rules Open

3.x

owasp-modsecurity/ModSecurity#2465 · 56 comments · 1 assignee · Opened Dec 2, 2020
IIS 10 + modsecurity on docker problem with SecDataDir Open

2.x Platform - IIS

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#2456 · 4 comments · Opened Nov 19, 2020
Collection multi vars Open

3.x

owasp-modsecurity/ModSecurity#2442 · 6 comments · 1 assignee · Opened Nov 4, 2020
ctl:ruleRemoveTargetByTag does not support regex in ModSecurity v3.x Open

3.x enhancement

owasp-modsecurity/ModSecurity#2432 · 2 comments · 5 reactions · 1 assignee · Opened Oct 22, 2020
'SecResponseBodyAccess Off' does not prevent response body from being logged (SecRuleEngine == DetectionOnly) Open

3.x

owasp-modsecurity/ModSecurity#2425 · 2 comments · 1 assignee · Opened Oct 19, 2020
Log sanitizer by help of nginx Open

3.x help wanted

Difficulty 5/5 Over a week Newbie friendliness 20/100

owasp-modsecurity/ModSecurity#2419 · 1 comment · Opened Oct 9, 2020
Log entries truncated Open

2.x

owasp-modsecurity/ModSecurity#2416 · 10 comments · 1 assignee · Opened Oct 6, 2020
Memory leak in msc_pregcomp_ex Open

2.x

Difficulty 3/5 1-2 days Newbie friendliness 45/100

owasp-modsecurity/ModSecurity#2407 · 2 comments · Opened Sep 22, 2020
SecRuleScript “Example Usage” errors w/ “directive Rule id: 0 is duplicated” Open

3.x

owasp-modsecurity/ModSecurity#2400 · 4 comments · 2 assignees · Opened Sep 14, 2020
`SecAuditLogStorageDir` behavior change from 2.9 to 3.x Open

3.x

owasp-modsecurity/ModSecurity#2392 · 11 comments · 1 assignee · Opened Sep 2, 2020
nginx worker hangs while logging to the audit log Open

3.x pending feedback

owasp-modsecurity/ModSecurity#2373 · 20 comments · 2 reactions · 2 assignees · Opened Jul 27, 2020
Parser for XML namespaces in xml rules is too restrictive Open

3.x

owasp-modsecurity/ModSecurity#2358 · 1 reaction · 1 assignee · Opened Jul 14, 2020
Command nginx -t create file modsec-shared-collections in directory where it run Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 30/100

owasp-modsecurity/ModSecurity#2354 · 2 comments · Opened Jul 9, 2020
Memory pointer error in JSON sanitization Open

2.x bug

owasp-modsecurity/ModSecurity#2344 · 6 comments · 1 assignee · Opened Jun 19, 2020
PATCH method dies with mod security with nginx configured as proxy/ingress Open

3.x Platform - Nginx workaround available

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#2341 · 22 comments · 1 reaction · Opened Jun 16, 2020
Timezone is not included in the time_stamp field of audit log in JSON format Open

3.x enhancement workaround available

owasp-modsecurity/ModSecurity#2340 · 12 comments · 1 assignee · Opened Jun 16, 2020
SecRuleRemoveById conflict with other Sec* Open

2.x Platform - Apache

owasp-modsecurity/ModSecurity#2325 · 3 comments · 1 assignee · Opened May 26, 2020
MS3 atomic updates of persistent integer variables doesnt work in MT environment Open

3.x

owasp-modsecurity/ModSecurity#2306 · 4 comments · 1 assignee · Opened May 4, 2020
AuditLogs are logging binary data and getting huge Open

2.x

owasp-modsecurity/ModSecurity#2289 · 8 comments · 1 assignee · Opened Apr 2, 2020
@eq operator should produce a warning if used with non-numeric value Open

3.x enhancement

owasp-modsecurity/ModSecurity#2281 · 1 reaction · 1 assignee · Opened Mar 11, 2020
Log output for JSON/XML error msg has an extra newline in it Open

3.x

owasp-modsecurity/ModSecurity#2278 · 3 comments · 1 assignee · Opened Mar 6, 2020
SecRequestBodyAccess Off doesn't fully disable request body processing Open

3.x

owasp-modsecurity/ModSecurity#2273 · 2 comments · 1 assignee · Opened Feb 28, 2020
Logging to NGINX error_log but not audit Open

3.x bug Platform - Nginx pr available

owasp-modsecurity/ModSecurity#2237 · 10 comments · 1 assignee · Opened Jan 13, 2020
@RBL with IPV6 support ? Open

3.x enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#2210 · 1 reaction · Opened Dec 3, 2019
Mod_security IPV6 ipMatchFromFile not working as expected. Open

2.x

owasp-modsecurity/ModSecurity#2192 · 7 comments · 1 assignee · Opened Oct 25, 2019
Confusing behaviour with variable remote_addr (behaviour depends on mod_remoteip being loaded) Open

2.x

owasp-modsecurity/ModSecurity#2172 · 1 comment · 1 reaction · 1 assignee · Opened Sep 27, 2019
Having exec working with scripts other than lua Open

3.x enhancement

owasp-modsecurity/ModSecurity#2167 · 6 comments · 1 reaction · 1 assignee · Opened Sep 18, 2019
clang: warning: comparison of constant 160 with expression of type 'char' is always false Open

3.x pending feedback

owasp-modsecurity/ModSecurity#2156 · 7 comments · 1 assignee · Opened Aug 26, 2019
Seclang parser issue: wrong '\\' sequence handling Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 38/100

owasp-modsecurity/ModSecurity#2148 · 6 comments · Opened Aug 14, 2019

owasp-modsecurity/ModSecurity

Get new issues in your inbox