Description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Libmodsecurity is one component of the ModSecurity v3 project. A segmentation fault occurs when a rule using the t:hexDecode transformation inspects a query string parameter containing a single character. An attacker can exploit this to crash worker processes, causing a denial of service. Service resumes once the attack stops as worker processes recover from the segfault. All versions before 3.0.15 of libModSecurity3 are affected. This has been patched in version 3.0.15.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| owasp-modsecurity | ModSecurity | < 3.0.15 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | modsecurity | 3.0.15-1 | — |
| Debian 13 | modsecurity | 3.0.14-1+deb13u1 | — |
| Debian 12 | modsecurity | 3.0.9-1+deb12u2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | modsecurity | No fix yet | — |
| Ubuntu 26.04 LTS | modsecurity | No fix yet | — |
| Ubuntu 25.10 | modsecurity | No fix yet | — |
| Ubuntu 24.04 LTS | modsecurity | No fix yet | — |
| Ubuntu 22.04 LTS | modsecurity | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | modsecurity | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | modsecurity | 3.0.15-1.1 | openSUSE-SU-2026:10732-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | mod_security | No fix yet | — |
Advisories 2
- WID-SEC-2026-1308 OWASP ModSecurity: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · May 12, 2026
- openSUSE-SU-2026:10732-1 libmodsecurity3-3.0.15-1.1 on GA media SUSE / openSUSE Security Updates · May 9, 2026