CVE-2026-52761

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 architecture. This issue is fixed in version 3.0.16.

CVSS v3 5.8 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/owasp-modsecurity/ModSecurity/commit/edcd010814e234d46e2ec55a0f1078ff9d3032e4	Patch
https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.16	Product Release Notes
https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-qjgm-7gp4-f8qq	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:owasp:modsecurity:*:*:*:*:*:*:*:*

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) ModSecurity es un motor de cortafuegos de aplicaciones web (WAF) de código abierto y multiplataforma para Apache, IIS y Nginx. Desde la versión 3.0.0 hasta la 3.0.15, la transformación t:utf8toUnicode en src/actions/transformations/utf8_to_unicode.cc produce una salida incorrecta en la arquitectura i386 porque snprintf utiliza sizeof en un puntero de tipo char en lugar de la longitud del búfer Unicode, lo que permite que las reglas que utilizan esta transformación sean eludidas en la arquitectura i386. Este problema está solucionado en la versión 3.0.16.

Information

Published : 2026-07-10 22:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-52761

Mitre link : CVE-2026-52761

CVE.ORG link : CVE-2026-52761

JSON object : View

Products Affected

owasp

modsecurity

CWE

CWE-467

Use of sizeof() on a Pointer Type

{"id": "CVE-2026-52761", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52761", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T14:08:45.655716Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "owasp-modsecurity", "product": "ModSecurity", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.0.16"}]}]}], "published": "2026-07-10T22:16:42.833", "references": [{"url": "https://github.com/owasp-modsecurity/ModSecurity/commit/edcd010814e234d46e2ec55a0f1078ff9d3032e4", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.16", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-qjgm-7gp4-f8qq", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-467"}]}], "descriptions": [{"lang": "en", "value": "ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 architecture. This issue is fixed in version 3.0.16."}, {"lang": "es", "value": "ModSecurity es un motor de cortafuegos de aplicaciones web (WAF) de c\u00f3digo abierto y multiplataforma para Apache, IIS y Nginx. Desde la versi\u00f3n 3.0.0 hasta la 3.0.15, la transformaci\u00f3n t:utf8toUnicode en src/actions/transformations/utf8_to_unicode.cc produce una salida incorrecta en la arquitectura i386 porque snprintf utiliza sizeof en un puntero de tipo char en lugar de la longitud del b\u00fafer Unicode, lo que permite que las reglas que utilizan esta transformaci\u00f3n sean eludidas en la arquitectura i386. Este problema est\u00e1 solucionado en la versi\u00f3n 3.0.16."}], "lastModified": "2026-10-25T15:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:owasp:modsecurity:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D21B0174-B358-44C3-BC59-186104086369", "versionEndIncluding": "3.0.15", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}