UpHeron
All vulnerabilities

Servers and applications

CVE-2021-42717

ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2…

Severity
High 7.5
Published
7 Dec 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.9.5, 3.0.6
Sources
NVD

Affected software

SoftwareAffected versions
ModSecurityServers and applications · cpe:a:owasp:modsecurity
  • From 3.0.0 before 3.0.6
ModSecurityServers and applications · cpe:a:trustwave:modsecurity
  • From 2.0.0 before 2.9.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-42717
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-42717