Skip to content
OpenAdvisories
Medium WID-SEC-2026-1308 2 CVEs

OWASP ModSecurity: Mehrere Schwachstellen ermöglichen Denial of Service

Published Apr 28, 2026 · Updated May 12, 2026 · Revision 4 · de-DE

Vendor: OWASP Vendor: SUSE Product: ModSecurity Product: openSUSE Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in OWASP ModSecurity ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

ModSecurity ist eine Open Source Web Application Firewall, die für verschiedene Webserver verfügbar ist.

Vulnerabilities 2

  • High 8.2
    CVE-2026-30923

    libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings

    ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Libmodsecurity is one component of the ModSecurity v3 project. A segmentation fault occurs when a rule using the t:hexDecode transformation inspects…

    owasp-modsecurity ModSecurity modsecurity modsecurity Debian Ubuntu Azure Linux
  • High 8.2
    CVE-2026-42268

    ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators

    ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exception (std::out_of_range) caused by unsigned integer underflow in libmodsecurity3 if the user…

    owasp-modsecurity ModSecurity modsecurity modsecurity Debian Ubuntu

Revision history

  1. #4

    Referenz(en) aufgenommen: EUVD-2026-29854

  2. #3

    Neue Updates von openSUSE aufgenommen

  3. #2

    Referenz(en) aufgenommen: EUVD-2026-27422

  4. #1

    Initiale Fassung

References