CVE-2007-1359: Mod Security

Medium severity, CVSS 6.8. EPSS: 6.8% chance of exploitation in the next 30 days.

Interpretation conflict in ModSecurity (mod_security) 2.1.0 and earlier allows remote attackers to bypass request rules via application/x-www-form-urlencoded POST data that contains an ASCIIZ (0x00) byte, which mod_security treats as a terminator even though it is still processed as normal data by some HTTP parsers including PHP 5.2.0, and possibly parsers in Perl, and Python.

Affected products

• Mod Security Mod Security: version 1.7 only; version 1.7.1 only; version 1.7.2 only; version 1.7.4 only; version 1.7.5 only; version 1.9.4 only; …

Published 2007-03-08. Last modified 2026-06-16.