ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 architecture. This issue is fixed in version 3.0.16.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| owasp-modsecurity | ModSecurity | 3.0.0 to before 3.0.16 | 3.0.16 | Patch available | CNA |
- ModSecurity Vendorowasp-modsecurity Affected 3.0.0 to before 3.0.16 Fixed in 3.0.16 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:owasp:modsecurity:*:*:*:*:*:*:*:* | 3.0.0 – 3.0.15 | Vulnerable | owasp-modsecurity |
- cpe:2.3:a:owasp:modsecurity:*:*:*:*:*:*:*:* Versions 3.0.0 – 3.0.15 Vulnerable ·owasp-modsecurity
Remediation
- Fix · CNA ModSecurity (owasp-modsecurity) Fixed in 3.0.16
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-52761
References
More owasp-modsecurity Modsecurity vulnerabilities
- TI-2026-37865 ModSecurity: Multipart form-data parser silently strips embedded line breaks from… CVSS 3.1HIGH 8.6
- TI-2026-30581 ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators CVSS 4.0HIGH 8.2
- TI-2026-23748 libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings CVSS 4.0HIGH 8.2
- TI-2025-31022 ModSecurity has possible DoS vulnerability in sanitiseArg action CVSS 3.1HIGH 7.5
- TI-2025-34348 ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure CVSS 4.0MEDIUM 6.9
- TI-2024-00942 WAF bypass of the ModSecurity v3 release line CVSS 3.1HIGH 8.6
Sources
- CVE-2026-52761 · CVE Program
- CVE-2026-52761 · NVD
- FIRST EPSS
- CVE-2026-52761 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences