owasp-modsecurity/ModSecurity

View on GitHub

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.

Stars: 9.8k
Forks: 1.8k
Open beginner issues: 0
Indexed issues: 265
Avg merge: 2h 46m
Merged PRs (30d): 1

Dominant language: C++
License: Apache-2.0
Last GitHub push: Jun 29, 2026
Latest indexed: Sep 20, 2026
Contributing guide: No contributing guide
Code of conduct: No code of conduct
Beginner labels: help wanted

Beginner friendly Everything

Open All

265 open issues indexed

Support ipv6 in the SecGeoLookupDb Open

2.x enhancement RIP - Type - Feature

owasp-modsecurity/ModSecurity#731 · 1 assignee · Opened Jun 2, 2014
Redirect action does not work properly in IIS Open

Platform - IIS

owasp-modsecurity/ModSecurity#729 · 5 comments · 1 assignee · Opened May 27, 2014
Support regular expression in ARGS selection while using ctl:ruleRemoveTargetById Open

2.x enhancement TBF by libmodsec waiting for v3

owasp-modsecurity/ModSecurity#717 · 6 comments · 5 reactions · 1 assignee · Opened May 6, 2014
Support macro expansion on ruleRemoveTargetById/ctl Open

enhancement RIP - Type - Feature TBF by libmodsec

Difficulty 3/5 1-2 days Newbie friendliness 45/100

owasp-modsecurity/ModSecurity#716 · Opened May 6, 2014
Operator validateurlencoding does not handle IIS url encoding "%uXXXX" Open

Platform - IIS

Difficulty 3/5 1-2 days Newbie friendliness 45/100

owasp-modsecurity/ModSecurity#704 · 2 comments · Opened Apr 17, 2014
Create support to t:jsonDecode Open

2.x 3.x RIP - libmodsecurity RIP - Type - Feature TBF by libmodsec

owasp-modsecurity/ModSecurity#687 · 9 comments · 1 assignee · Opened Mar 31, 2014
Delimiters in @pm, @within, etc. Open

3.x RIP - Type - Feature

owasp-modsecurity/ModSecurity#682 · 2 comments · 1 assignee · Opened Mar 19, 2014
sanitiseMatchedBytes only sanitizes the first match Open

bug enhancement Platform - Apache Platform - IIS Platform - Java Platform - Nginx Platform - Standalone TBF by libmodsec

owasp-modsecurity/ModSecurity#673 · 1 assignee · Opened Mar 7, 2014
Santization issues when using part H Open

2.x enhancement TBF by libmodsec

owasp-modsecurity/ModSecurity#535 · 2 comments · 1 assignee · Opened Oct 17, 2013
Sub-phases Open

RIP - Type - Feature

owasp-modsecurity/ModSecurity#371 · 1 comment · 1 assignee · Opened Oct 17, 2013
append data to variables Open

2.x 3.x RIP - Type - Feature TBF by libmodsec

owasp-modsecurity/ModSecurity#340 · 21 comments · 1 assignee · Opened Oct 17, 2013
customize drop status code replacement on Windows Open

enhancement Platform - IIS

owasp-modsecurity/ModSecurity#328 · 2 comments · 2 assignees · Opened Oct 17, 2013
Basic streaming detection on raw request/response Open

2.x 3.x bug enhancement

owasp-modsecurity/ModSecurity#304 · 4 comments · 1 assignee · Opened Oct 17, 2013
The SCRIPT_* family of variables can be accessed in phase 1 and returns invalid data Open

enhancement

owasp-modsecurity/ModSecurity#235 · 2 comments · 2 assignees · Opened Oct 17, 2013
Expand macro functionality Open

2.x 3.x enhancement TBF by libmodsec

owasp-modsecurity/ModSecurity#215 · 5 comments · 1 assignee · Opened Oct 17, 2013

owasp-modsecurity/ModSecurity

Get new issues in your inbox