Home

Description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exception (std::out_of_range) caused by unsigned integer underflow in libmodsecurity3 if the user (administrator) uses a rule any of @verifySSN, @verifyCPF, or @verifySVNR. This vulnerability is fixed in 3.0.15.

PUBLISHED Reserved 2026-04-26 | Published 2026-05-12 | Updated 2026-05-14 | Assigner GitHub_M




HIGH: 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-191: Integer Underflow (Wrap or Wraparound)

CWE-248: Uncaught Exception

Product status

>= 3.0.0, < 3.0.15
affected

References

github.com/...curity/security/advisories/GHSA-vwr3-7x7g-7p9w exploit

github.com/...curity/security/advisories/GHSA-vwr3-7x7g-7p9w

cve.org (CVE-2026-42268)

nvd.nist.gov (CVE-2026-42268)

Download JSON