ModSecurity vulnerabilities
4 known CVE vulnerabilities in ModSecurity, translated and rated.
- CVE-2026-42268High
ModSecurity is a web application firewall engine that from versions 3.0.0 to before 3.0.15 contains an unhandled exception caused by unsigned integer underflow. This issue occurs when the administrator uses the @verifySSN, @verifyCPF, or @verifySVNR rule.
- CVE-2026-52761Medium
A vulnerability in ModSecurity versions 3.0.0 through 3.0.15 affects the t:utf8toUnicode transformation on i386 architecture. The snprintf function uses the size of a pointer instead of the Unicode buffer length, causing incorrect output and allowing WAF rule bypass.
- CVE-2026-52747High
ModSecurity before version 3.0.16 has a vulnerability in the multipart/form-data parser that silently removes line breaks from non-file form-field values. This occurs because the code overwrites reserved bytes instead of appending the current buffer, causing a parser differential between ModSecurity and backend applications.
- CVE-2023-38285High
ModSecurity 3.x before 3.0.10 has an issue with inefficient algorithmic complexity.