CVE-2026-52761 — ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture

Description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 architecture. This issue is fixed in version 3.0.16.

Affected products

Vendor	Product	Affected	Fixed
owasp-modsecurity	ModSecurity	>= 3.0.0, < 3.0.16	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	modsecurity	3.0.16-1	—
Debian 13	modsecurity	No fix yet	—
Debian 12	modsecurity	No fix yet	—

Ubuntu