owasp-modsecurity/ModSecurity

View on GitHub

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.

Stars: 9.8k
Forks: 1.8k
Open beginner issues: 0
Indexed issues: 265
Avg merge: 2h 46m
Merged PRs (30d): 1

Dominant language: C++
License: Apache-2.0
Last GitHub push: Jun 29, 2026
Latest indexed: Sep 20, 2026
Contributing guide: No contributing guide
Code of conduct: No code of conduct
Beginner labels: help wanted

Beginner friendly Everything

Open All

265 issues indexed so far

IIS: IPv6 link-local client addresses break IP matching ("IPmatch: bad IPv6 specification") Open

2.x Platform - IIS

Difficulty 2/5 1-3 hours Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3630 · Opened Sep 17, 2026
IIS: ReadFileChunk allocates only 1 byte but reads m_dwPageSize (latent overflow) Open

2.x Platform - IIS

Difficulty 1/5 Under an hour Newbie friendliness 90/100

owasp-modsecurity/ModSecurity#3623 · 1 comment · Opened Aug 27, 2026
IIS: Host header fallback is dead code (r->hostname == NULL can never be true) Open

2.x Platform - IIS

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

owasp-modsecurity/ModSecurity#3621 · 1 comment · Opened Aug 27, 2026
IIS: Content-Length header corrupted/truncated for large responses (wrong printf format + off-by-one buffer size) Open

2.x Platform - IIS

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

owasp-modsecurity/ModSecurity#3619 · 1 comment · Opened Aug 27, 2026
IIS connector: audit log F part always shows '500 Internal Server Error' for normal traffic Open

2.x Platform - IIS

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

owasp-modsecurity/ModSecurity#3612 · 1 comment · Opened Aug 14, 2026
multipart C-T header validation - false positive (rule id 200002, Multiple boundary parameters) Open

3.x bug

Difficulty 3/5 1-2 days Newbie friendliness 68/100

owasp-modsecurity/ModSecurity#3610 · 3 comments · Opened Aug 13, 2026
libModSecurity3: REQUEST_HEADERS names are treated as case sensitive with configure-time rule-exclusions Open

:1st_place_medal: good first issue 3.x

Difficulty 3/5 1-2 days Newbie friendliness 64/100

owasp-modsecurity/ModSecurity#3609 · 2 comments · Opened Aug 7, 2026
Windows build fails: yajl's Conan recipe sets CMP0026 OLD, incompatible with newer CMake Open

3.x windows

Difficulty 4/5 3-5 days Newbie friendliness 52/100

owasp-modsecurity/ModSecurity#3604 · 2 comments · Opened Jul 28, 2026
Partial Log Forging in RuleMessage::log() via Unescaped Quote Characters in Request-Derived Fields Open

3.x

Difficulty 3/5 1-2 days Newbie friendliness 75/100

owasp-modsecurity/ModSecurity#3601 · 3 comments · Opened Jul 20, 2026
x86 IIS module in CI-built MSI fails to load - fuzzy.dll missing MinGW runtime DLLs (error 126) Open

2.x

Difficulty 3/5 1-2 days Newbie friendliness 72/100

owasp-modsecurity/ModSecurity#3599 · 1 comment · Opened Jul 17, 2026
GnuTLS after many apache reloads Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 48/100

owasp-modsecurity/ModSecurity#3590 · 9 comments · Opened Jun 29, 2026
@ipMatchFromFile and @ipMatch code (same code in v2 & v3) becomes buggy from a certain number of IP. Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 42/100

owasp-modsecurity/ModSecurity#3588 · 3 comments · Opened Jun 28, 2026
ModSecurity POST: SQLi bypass via request-body predicate/operator rewrites Open

3.x

Difficulty 5/5 Over a week Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3587 · 1 comment · Opened Jun 27, 2026
ModSecurity GET(JSON): SQLi bypass via separator, literal, and annotation variants Open

Difficulty 5/5 Over a week Newbie friendliness 28/100

owasp-modsecurity/ModSecurity#3586 · 1 comment · Opened Jun 27, 2026
ModSecurity GET: SQLi bypass via scalar-expression and operator rewrites Open

3.x

Difficulty 5/5 Over a week Newbie friendliness 42/100

owasp-modsecurity/ModSecurity#3585 · 2 comments · Opened Jun 27, 2026
Fix Failing to Match IPv6 Addresses@ipMatchFromFile Open

3.x

Difficulty 3/5 1-2 days Newbie friendliness 48/100

owasp-modsecurity/ModSecurity#3584 · 8 comments · Opened Jun 27, 2026
Apache-Error: [file "apache2_util.c"] [line 275] [level 3] ModSecurity: JSON parsing error: lexical error: invalid char in json text. Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3581 · 3 comments · Opened Jun 19, 2026
SecUploadFileMode parsed as decimal instead of octal; temp files have no read permission Open

3.x

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

owasp-modsecurity/ModSecurity#3580 · 1 comment · Opened Jun 17, 2026
wiki: Remove deprecated REQBODY_PROCESSOR_ERROR and REQBODY_PROCESSOR_ERROR_MSG from wiki pages Open

2.x

Difficulty 2/5 1-3 hours Newbie friendliness 48/100

owasp-modsecurity/ModSecurity#3576 · 9 comments · Opened Jun 16, 2026
Ubuntu nginx 1.24.0-2ubuntu7.10 crashes workers with ngx_http_modsecurity_module enabled; 1.24.0-2ubuntu7.9 works Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 55/100

owasp-modsecurity/ModSecurity#3572 · 3 comments · 2 reactions · Opened Jun 9, 2026
Audit log match does not represent chained rules Open

3.x duplicate

Difficulty 4/5 3-5 days Newbie friendliness 48/100

owasp-modsecurity/ModSecurity#3569 · 1 comment · Opened May 19, 2026
REQBODY_ERROR "Extra content at the end of the document" after 3.0.15 update Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 38/100

owasp-modsecurity/ModSecurity#3563 · 11 comments · Opened May 13, 2026
Hit rule and record request_body log. Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 42/100

owasp-modsecurity/ModSecurity#3561 · 3 comments · Opened May 11, 2026
Exclude .gitignore files from release tarballs Open

3.x

Difficulty 3/5 1-2 days Newbie friendliness 48/100

owasp-modsecurity/ModSecurity#3559 · 6 comments · Opened May 8, 2026
Log message should indicate if operator is negative Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

owasp-modsecurity/ModSecurity#3554 · 1 comment · Opened May 2, 2026
Remove code specific to Internet Explorer Open

2.x 3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3549 · 2 comments · Opened Apr 20, 2026
Potential regex compilation failure or mismatch with variable-length lookbehind in PCRE patterns Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 48/100

owasp-modsecurity/ModSecurity#3537 · 2 comments · Opened Apr 7, 2026
Add performance audit document for ModSecurity v3 Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3536 · Opened Apr 5, 2026
Feature Request: Wildcard/pattern support in ctl:ruleRemoveTargetById (v3) Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 48/100

owasp-modsecurity/ModSecurity#3505 · 7 comments · 2 reactions · Opened Feb 28, 2026
Feature Request: Add `ARGS_RAW`, `ARGS_GET_RAW`, `ARGS_POST_RAW`, and `ARGS_NAMES_RAW` Variables Open

new feature

Difficulty 5/5 Over a week Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3501 · 4 comments · Opened Feb 18, 2026
Inconsistent Error Log Format of ModSecurity depending on Apache's ErrorLogFormat directive Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3472 · 7 comments · Opened Dec 2, 2025
AFL fuzzer reports Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3469 · 3 comments · Opened Nov 21, 2025
Variable needed : REQUEST_HAS_BODY to avoid content-type evasion Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3466 · 3 comments · Opened Nov 20, 2025
No "real" capture of HTTP:BL response Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3465 · 8 comments · Opened Nov 14, 2025
2.x standalone fails to link since ap_map_http_request_error() is not exported as APR function Open

2.x

Difficulty 3/5 1-2 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3451 · 2 comments · Opened Oct 22, 2025
Question: how is setenv supposed to work in ModSecurity 3.0.x Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3449 · 3 comments · Opened Oct 17, 2025
ModSecurity v2.9.12 “Skipping request since there is nowhere to write to” despite valid SecAuditLog configuration Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 45/100

owasp-modsecurity/ModSecurity#3446 · 10 comments · Opened Oct 15, 2025
2.9.12 installer Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

owasp-modsecurity/ModSecurity#3440 · 2 comments · Opened Sep 5, 2025
Stack overflow in pcre.dll Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3436 · 10 comments · Opened Aug 22, 2025
Recommended rule 200005 misses MSC_PCRE_LIMITS_EXCEEDED in phase 2 Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3415 · 2 comments · 1 reaction · Opened Jul 9, 2025
High RAM Usage with Concurrent Logging Mode in ModSecurity Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3414 · 8 comments · Opened Jul 7, 2025
request on iis with more than 999 characters single value in cookie are getting blocked and no specific rule to fix Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3413 · 1 comment · Opened Jul 6, 2025
Performance issues with ModSecurity2/Alpine/PCRE2 Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3409 · 5 comments · 1 reaction · Opened Jun 23, 2025
Event message with description "Invalid function" in the Windows Application Event Log Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 45/100

owasp-modsecurity/ModSecurity#3408 · 13 comments · Opened Jun 23, 2025
Enhancement: Extend CI workflow to test library detection with manually compiled dependencies Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3407 · 10 comments · 1 reaction · Opened Jun 22, 2025
ModSecurity 3.0.14 configure script fails to detect lib64-installed YAJL, LMDB, and PCRE2 Open

3.x

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

owasp-modsecurity/ModSecurity#3404 · 2 comments · 1 reaction · Opened Jun 19, 2025
Audit log no longer written since update to 3.0.14 Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 38/100

owasp-modsecurity/ModSecurity#3402 · 6 comments · Opened Jun 16, 2025
2,9,7 Appl Error 1000 in w3wp.exe Module ucrtbase.dll Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3397 · 14 comments · Opened Jun 6, 2025
ip collection does not seem to work properly with latest ModSecurity Open

3.x

owasp-modsecurity/ModSecurity#3394 · 24 comments · 1 assignee · Opened May 29, 2025
Behavior change in regex macro expansion from 2.9.7 to 2.9.8 affecting CRS 3.2.x and 3.3.x Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3380 · 8 comments · Opened May 12, 2025

owasp-modsecurity/ModSecurity

Get new issues in your inbox