CVE-2023-38285
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
ModSecurity 3.x before 3.0.10 has an issue with inefficient algorithmic complexity.
Risk Assessment
Exploitation of this vulnerability may lead to decreased system performance, potentially affecting service availability.
Recommendation
It is recommended to upgrade ModSecurity to version 3.0.10 or later to mitigate the risk associated with this vulnerability.
Other vulnerabilities in ModSecurity 3.x
See all- CVE-2026-42268High
ModSecurity is a web application firewall engine that from versions 3.0.0 to before 3.0.15 contains an unhandled exception caused by unsigned integer underflow. This issue occurs when the administrator uses the @verifySSN, @verifyCPF, or @verifySVNR rule.
- CVE-2026-52761Medium
A vulnerability in ModSecurity versions 3.0.0 through 3.0.15 affects the t:utf8toUnicode transformation on i386 architecture. The snprintf function uses the size of a pointer instead of the Unicode buffer length, causing incorrect output and allowing WAF rule bypass.
- CVE-2026-52747High
ModSecurity before version 3.0.16 has a vulnerability in the multipart/form-data parser that silently removes line breaks from non-file form-field values. This occurs because the code overwrites reserved bytes instead of appending the current buffer, causing a parser differential between ModSecurity and backend applications.
Original NVD description (English source)
Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity.