CVE-2026-42268
HighSummary
ModSecurity is a web application firewall engine that from versions 3.0.0 to before 3.0.15 contains an unhandled exception caused by unsigned integer underflow. This issue occurs when the administrator uses the @verifySSN, @verifyCPF, or @verifySVNR rule.
Risk Assessment
Exploitation of this vulnerability may lead to unforeseen errors in the firewall's operation, potentially lowering the security level of web applications.
Recommendation
It is recommended to update ModSecurity to version 3.0.15 or newer to mitigate this vulnerability.
Other vulnerabilities in ModSecurity
See all- CVE-2026-52761Medium
A vulnerability in ModSecurity versions 3.0.0 through 3.0.15 affects the t:utf8toUnicode transformation on i386 architecture. The snprintf function uses the size of a pointer instead of the Unicode buffer length, causing incorrect output and allowing WAF rule bypass.
- CVE-2026-52747High
ModSecurity before version 3.0.16 has a vulnerability in the multipart/form-data parser that silently removes line breaks from non-file form-field values. This occurs because the code overwrites reserved bytes instead of appending the current buffer, causing a parser differential between ModSecurity and backend applications.
- CVE-2023-38285High
ModSecurity 3.x before 3.0.10 has an issue with inefficient algorithmic complexity.
Original NVD description (English source)
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exception (std::out_of_range) caused by unsigned integer underflow in libmodsecurity3 if the user (administrator) uses a rule any of @verifySSN, @verifyCPF, or @verifySVNR. This vulnerability is fixed in 3.0.15.