CVE-2026-52761
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A vulnerability in ModSecurity versions 3.0.0 through 3.0.15 affects the t:utf8toUnicode transformation on i386 architecture. The snprintf function uses the size of a pointer instead of the Unicode buffer length, causing incorrect output and allowing WAF rule bypass.
Risk Assessment
Organizations running ModSecurity on i386 systems may face attacks that bypass security rules, increasing the risk of unauthorized access or web application attacks.
Recommendation
Upgrade ModSecurity to version 3.0.16 or later immediately to fix this vulnerability.
Other vulnerabilities in ModSecurity
See all- CVE-2026-42268High
ModSecurity is a web application firewall engine that from versions 3.0.0 to before 3.0.15 contains an unhandled exception caused by unsigned integer underflow. This issue occurs when the administrator uses the @verifySSN, @verifyCPF, or @verifySVNR rule.
- CVE-2026-52747High
ModSecurity before version 3.0.16 has a vulnerability in the multipart/form-data parser that silently removes line breaks from non-file form-field values. This occurs because the code overwrites reserved bytes instead of appending the current buffer, causing a parser differential between ModSecurity and backend applications.
- CVE-2023-38285High
ModSecurity 3.x before 3.0.10 has an issue with inefficient algorithmic complexity.
Original NVD description (English source)
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 architecture. This issue is fixed in version 3.0.16.