owasp-modsecurity/ModSecurity

View on GitHub

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.

Stars: 9.8k
Forks: 1.8k
Open beginner issues: 0
Indexed issues: 265
Avg merge: 2h 46m
Merged PRs (30d): 1

Dominant language: C++
License: Apache-2.0
Last GitHub push: Jun 29, 2026
Latest indexed: Sep 20, 2026
Contributing guide: No contributing guide
Code of conduct: No code of conduct
Beginner labels: help wanted

Beginner friendly Everything

Open All

265 open issues indexed

REQUEST_BODY is set when it should not according to documentation Open

3.x

owasp-modsecurity/ModSecurity#2146 · 16 comments · 1 assignee · Opened Aug 14, 2019
Error parsing % Open

3.x enhancement

owasp-modsecurity/ModSecurity#2145 · 3 comments · 3 assignees · Opened Aug 7, 2019
mod_security causes CGI scripts to timeout Open

2.x Platform - Apache

owasp-modsecurity/ModSecurity#2101 · 20 comments · 2 assignees · Opened May 22, 2019
Don't run request body completion checks when ProcessPartial and the input filter has't seen all of the body Open

2.x enhancement pr available

owasp-modsecurity/ModSecurity#2093 · 18 comments · 4 reactions · 2 assignees · Opened May 14, 2019
Windows Server 2016 / IIS Cannot Disable for site Open

2.x Platform - IIS workaround available

owasp-modsecurity/ModSecurity#2082 · 1 comment · 1 assignee · Opened May 6, 2019
Incomplete type declaration for `KeyExclusions` [pymodsecurity] Open

3.x enhancement

owasp-modsecurity/ModSecurity#2078 · 1 comment · 1 reaction · 1 assignee · Opened Apr 25, 2019
rotatelogs.exe Not Working in IIS 10 with v2.9.3 Open

2.x Platform - IIS workaround available

owasp-modsecurity/ModSecurity#2075 · 5 comments · 1 assignee · Opened Apr 21, 2019
Nginx libmodsecurity v3.0 JSON Log format don't show alert action description Open

3.x enhancement

owasp-modsecurity/ModSecurity#2054 · 1 assignee · Opened Mar 26, 2019
"Database is not open. Use: SecGeoLookupDb directive." after reload Open

3.x enhancement workaround available

owasp-modsecurity/ModSecurity#2041 · 14 comments · 1 reaction · 1 assignee · Opened Mar 7, 2019
IIS MSI installers not following MS standard for digital signature Open

2.x enhancement Platform - IIS workaround available

owasp-modsecurity/ModSecurity#1999 · 4 comments · 1 assignee · Opened Jan 11, 2019
Support for RE2 regular expression engine Open

3.x

owasp-modsecurity/ModSecurity#1996 · 9 comments · 6 reactions · 1 assignee · Opened Jan 10, 2019
Modsecurity IIS remote_address empty in case of IPv6 address - IPmatch: bad IPv4 specification Open

2.x Platform - IIS

owasp-modsecurity/ModSecurity#1988 · 2 comments · 1 assignee · Opened Dec 24, 2018
Rule set to block requests to overloaded proxied hosts Open

enhancement

owasp-modsecurity/ModSecurity#1987 · 1 comment · 1 assignee · Opened Dec 19, 2018
Information disclosure - statuscode response containing WAF type Open

2.x Platform - IIS

Difficulty 3/5 1-2 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#1975 · 4 comments · Opened Dec 7, 2018
Implements the ability to reload the rules without restart Open

3.x new feature

owasp-modsecurity/ModSecurity#1970 · 7 reactions · 1 assignee · Opened Nov 30, 2018
Add interface in libModSecurity for reopening log files Open

3.x new feature RIP - libmodsecurity RIP - Type - Feature

owasp-modsecurity/ModSecurity#1968 · 3 comments · 2 assignees · Opened Nov 28, 2018
modsecurity 3.0.x. What's the DeprecateVar alternative ? Open

3.x RIP - libmodsecurity RIP - Type - Usage

owasp-modsecurity/ModSecurity#1944 · 7 comments · 1 assignee · Opened Oct 29, 2018
Updating RequestBodyNoFilesLimit at runtime (feature request) Open

2.x waiting for v3

owasp-modsecurity/ModSecurity#1933 · 8 comments · 1 assignee · Opened Oct 21, 2018
Implement support to Sanitize on v3 Open

3.x libmodsec - missing features RIP - libmodsecurity

owasp-modsecurity/ModSecurity#1898 · 15 comments · 2 reactions · 1 assignee · Opened Sep 12, 2018
Proposal to enforce requestBodyProcessor=URLENCODED via recommended rules Open

3.x

owasp-modsecurity/ModSecurity#1813 · 1 assignee · Opened Jun 21, 2018
META-ISSUE: Performance task force Open

3.x enhancement RIP - libmodsecurity

owasp-modsecurity/ModSecurity#1734 · 6 comments · 1 reaction · 1 assignee · Opened Apr 6, 2018
t:htmlEntityDecode doesn't support all text entities. Open

2.x 3.x RIP - libmodsecurity TBF by libmodsec

owasp-modsecurity/ModSecurity#1509 · 1 assignee · Opened Jul 24, 2017
Multipart: Final boundary missing. Open

2.x workaround available

owasp-modsecurity/ModSecurity#1471 · 24 comments · 2 reactions · 1 assignee · Opened Jun 26, 2017
ModSecurity IIS module add content-length when chunked transfer encoding is enabled Open

2.x enhancement Platform - IIS pr available

owasp-modsecurity/ModSecurity#1364 · 2 comments · 1 assignee · Opened Mar 24, 2017
New operator: Check if transformation changed input Open

enhancement RIP - Type - Feature TBF by libmodsec

Difficulty 5/5 Over a week Newbie friendliness 28/100

owasp-modsecurity/ModSecurity#1293 · 2 comments · Opened Dec 28, 2016
User-defined transformations Open

RIP - Type - Feature TBF by libmodsec

owasp-modsecurity/ModSecurity#1238 · 2 comments · 2 reactions · 1 assignee · Opened Oct 20, 2016
`utf8toUnicode` encodes to ambigious hex sequences Open

2.x enhancement waiting for v3

owasp-modsecurity/ModSecurity#1211 · 2 comments · 2 assignees · Opened Sep 10, 2016
Implement Memcache support as Collection backend on libmodsecurity Open

libmodsec - missing features RIP - libmodsecurity

owasp-modsecurity/ModSecurity#1140 · 2 comments · 2 reactions · 1 assignee · Opened May 5, 2016
Implement Redis support as Collection backend on libmodsecurity Open

libmodsec - missing features RIP - libmodsecurity

owasp-modsecurity/ModSecurity#1139 · 13 comments · 12 reactions · 1 assignee · Opened May 5, 2016
Add support for santization of arguments within the error log Open

enhancement RIP - libmodsecurity RIP - Type - Feature TBF by libmodsec

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#1132 · Opened Apr 26, 2016
[feature request] Macro expansion when counting/comparing variables Open

enhancement RIP - Type - Feature TBF by libmodsec

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#1131 · 7 comments · Opened Apr 26, 2016
Request header tagging not working on IIS Open

Platform - IIS

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#1106 · 4 comments · Opened Mar 29, 2016
Allow all SanatizeArgs variants to return a fixed amount of asterisks Open

enhancement RIP - Type - Feature TBF by libmodsec

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#1102 · 2 comments · Opened Mar 24, 2016
Ability to set msg in subsequent chained rules Open

enhancement RIP - libmodsecurity RIP - Type - Feature

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#1079 · 5 comments · Opened Feb 13, 2016
Implement the support to Python scripts into libModSecurity Open

enhancement libmodsec - missing features RIP - libmodsecurity RIP - Type - Feature TBF by libmodsec

Difficulty 5/5 Over a week Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#995 · 1 reaction · Opened Dec 8, 2015
Implement the @inspectMimeType operator Open

enhancement RIP - libmodsecurity RIP - Type - Feature TBF by libmodsec

Difficulty 5/5 Over a week Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#993 · 1 comment · Opened Dec 8, 2015
XML parser does not properly return values with anonymous namespaces Open

enhancement

owasp-modsecurity/ModSecurity#947 · 1 assignee · Opened Oct 21, 2015
XML rule processing action Open

RIP - libmodsecurity RIP - Type - Feature

owasp-modsecurity/ModSecurity#945 · 1 assignee · Opened Oct 16, 2015
Response body scanning conflicts with mod_deflate Open

2.x enhancement pending feedback

owasp-modsecurity/ModSecurity#944 · 16 comments · 1 assignee · Opened Oct 15, 2015
[feature request] operator to count number of matches from file Open

enhancement RIP - libmodsecurity RIP - Type - Feature TBF by libmodsec waiting for v3

owasp-modsecurity/ModSecurity#936 · 1 reaction · 1 assignee · Opened Sep 26, 2015
ctl:removeTargetById doesn't know how to work with regex Open

2.x 3.x enhancement RIP - libmodsecurity RIP - Type - Feature TBF by libmodsec

owasp-modsecurity/ModSecurity#911 · 6 comments · 4 reactions · 1 assignee · Opened Jul 14, 2015
Sorted collections Open

pending feedback RIP - Type - Feature RIP - Type - Usage TBF by libmodsec

Difficulty 5/5 Over a week Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#903 · 4 comments · Opened Jun 18, 2015
MTOM requests fail (content-type XOP) Open

enhancement workaround available

owasp-modsecurity/ModSecurity#902 · 14 comments · 2 assignees · Opened Jun 17, 2015
Issue with @inspectFile CGI environment variable PATH_TRANSLATED Open

bug Platform - Apache RIP - Type - Feature

owasp-modsecurity/ModSecurity#868 · 5 comments · 1 assignee · Opened Apr 16, 2015
sanitiseMatchedBytes range does not work on POST arguments Open

2.x 3.x enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#841 · 1 comment · Opened Feb 17, 2015
rsub capturing group Open

2.x enhancement RIP - Type - Feature

owasp-modsecurity/ModSecurity#828 · 3 comments · 1 assignee · Opened Jan 18, 2015
IIS8.5 - ModSecurity 2.8 - Access denied folder loop handling prevents proper config loading Open

2.x bug Platform - IIS

owasp-modsecurity/ModSecurity#812 · 1 assignee · Opened Dec 9, 2014
ModSecurity IIS startup message is flooding the event log Open

enhancement Platform - IIS RIP - Type - Feature

owasp-modsecurity/ModSecurity#784 · 2 comments · 1 assignee · Opened Oct 8, 2014
Bad performance when used with threaded mpms and a libapr compiled with "--enable-allocator-uses-mmap" option Open

Platform - Apache

owasp-modsecurity/ModSecurity#768 · 6 comments · 2 assignees · Opened Aug 18, 2014
@validateSchema or xml body parser in others that are not the request body Open

3.x enhancement RIP - libmodsecurity

Difficulty 5/5 Over a week Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#739 · Opened Jun 13, 2014

owasp-modsecurity/ModSecurity

Get new issues in your inbox