CVE-2024-46292

What it actually does

Buffer overflow in name parameter handling of modsecurity v3.0.12 that may trigger denial of service, though the issue is disputed by the supplier as unreproducible and tied to unsupported large SecRequestBodyNoFilesLimit values.

Why it matters to the business

Low risk of service disruption from potential crashes in web request processing; no known exploitation or ransomware use, with minimal downstream dependents and stable low EPSS over 30 days, so operational impact remains negligible absent confirmation.

How an attack unfolds

An attacker would attempt to supply oversized crafted data in the name parameter to overflow a buffer and crash the service, but the vector remains unconfirmed and documentation warns against very large SecRequestBodyNoFilesLimit settings required for the claimed effect.

How to fix it

Upgrade affected packages to the listed fixed versions such as php (Mageia:8) 8.0.11-1.mga8; review and constrain SecRequestBodyNoFilesLimit per product documentation; monitor supplier statements on the disputed status.

How to confirm the fix worked

Verify installed version against fixed releases; attempt reproduction only in isolated test environments while noting supplier dispute; inspect configuration for excessive SecRequestBodyNoFilesLimit values.

Typical attack path

1. Send HTTP request containing oversized or malformed name parameter
2. Trigger buffer handling code path in modsecurity
3. Cause memory corruption leading to process crash or DoS

How to detect it

Review web server and modsecurity logs for unusually large name parameters or request bodies; monitor for unexpected process crashes or restarts coinciding with traffic spikes; no confirmed threat actor activity reported.

What your security team should do

• Apply available package updates promptly despite low EPSS
• Audit modsecurity configurations for SecRequestBodyNoFilesLimit
• Track supplier updates on the disputed reproduction status