Skip to main content

ModSecurity CVE-2026-30923

| EUVDEUVD-2026-27422 HIGH
Out-of-bounds Read (CWE-125)
2026-05-05 GitHub_M
Denial Of Service Apache Buffer Overflow Nginx Information Disclosure Modsecurity
8.2
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.5 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
May 05, 2026 - 20:02 EUVD
Source Code Evidence Fetched
May 05, 2026 - 19:31 vuln.today
Analysis Generated
May 05, 2026 - 19:31 vuln.today
CVSS changed
May 05, 2026 - 19:22 NVD
8.2 (HIGH)

DescriptionCVE.org

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Libmodsecurity is one component of the ModSecurity v3 project. A segmentation fault occurs when a rule using the t:hexDecode transformation inspects a query string parameter containing a single character. An attacker can exploit this to crash worker processes, causing a denial of service. Service resumes once the attack stops as worker processes recover from the segfault. All versions before 3.0.15 of libModSecurity3 are affected. This has been patched in version 3.0.15.

AnalysisAI

Worker process crashes occur in ModSecurity (libmodsecurity3) when processing query string parameters containing single characters through the t:hexDecode transformation function. Remote unauthenticated attackers can trigger repeated segmentation faults to disrupt web application firewall protection, though service automatically recovers once the attack ceases. All libmodsecurity3 versions before 3.0.15 are affected across Apache, IIS, and Nginx deployments. OWASP confirmed the vulnerability via GitHub security advisory GHSA-qrjc-3jpc-3h2g and released patch version 3.0.15 addressing this buffer overflow (CWE-125: Out-of-bounds Read).

Technical ContextAI

ModSecurity v3 uses libmodsecurity3 as its core WAF engine, implementing transformation functions that normalize input data before rule evaluation. The t:hexDecode transformation converts hexadecimal-encoded strings to their ASCII equivalents, commonly used to detect obfuscated attack payloads. The vulnerability stems from CWE-125 (Out-of-bounds Read) in hex_decode.cc, where processing a single-character query string parameter triggers an unsigned integer underflow or improper bounds check. When the transformation attempts to read beyond allocated memory, the process encounters a segmentation fault. This affects all web server integrations (Apache, IIS, Nginx) since the flaw exists in the shared libmodsecurity3 library. The CPE identifier cpe:2.3:a:owasp-modsecurity:modsecurity confirms OWASP as the maintaining organization. GitHub release notes indicate this was one of multiple buffer overflow issues (CVE-2026-30923, CVE-2026-42268, plus three additional buffer overflows in multipart processing, ACMP pattern matching, and SecLang scanner) addressed in the 3.0.15 security release.

RemediationAI

Upgrade libmodsecurity3 to version 3.0.15 or later, released by OWASP on GitHub at https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.15. The patch fixes the buffer overflow in hex_decode.cc along with multiple other security issues including CVE-2026-42268 (unsigned integer underflow in verify operators), buffer overflows in multipart body processing, heap buffer overflow in ACMP pattern matching, nullptr dereference in SecLang scanner, and undefined behavior in ip_tree. For organizations unable to immediately upgrade, implement compensating controls with awareness of their limitations: disable or comment out ModSecurity rules that apply the t:hexDecode transformation to query string parameters (search ruleset files for 'ARGS' scope with 't:hexDecode'), which eliminates the vulnerable code path but reduces detection coverage for hex-encoded attacks. Alternatively, deploy rate limiting or connection throttling at the web server or load balancer layer to mitigate repeated crash attempts, though this does not prevent the segfault itself and may impact legitimate traffic during attacks. Monitor web server error logs for segmentation fault patterns indicating exploitation attempts. Note that version 3.0.15 also updates dependencies to mbedTLS 4.1.0 and libinjection 4.0.0, so verify compatibility with existing integrations before deploying to production.

More in Modsecurity

View all
CVE-2025-27110 HIGH POC
7.9 Feb 25

Libmodsecurity is one component of the ModSecurity v3 project. Rated high severity (CVSS 7.9), this vulnerability is rem
CVE-2025-48866 HIGH POC
7.5 Jun 02

ModSecurity versions prior to 2.9.10 contain a denial of service vulnerability in the `sanitiseArg` and `sanitizeArg` ac
CVE-2021-42717 HIGH POC
7.5 Dec 07

ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Rated high severity (CVSS 7.5), this vulnerabi
CVE-2020-15598 HIGH POC
7.5 Oct 06

Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. Rated high severity (CVSS 7.5),

CVE-2012-4528 MEDIUM POC
5.0 Dec 28

The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver ar
CVE-2018-13065 MEDIUM POC
6.1 Jul 03

ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. Rated medium severity (CVSS 6.1), this vulnerabili
CVE-2013-2765 MEDIUM POC
5.0 Jul 15

The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NUL
CVE-2013-5705 MEDIUM POC
5.0 Apr 15

apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer codi
CVE-2026-52747 HIGH
8.6 Jul 10

WAF filtering bypass in OWASP ModSecurity (libmodsecurity) before 3.0.16 lets remote unauthenticated attackers smuggle m
CVE-2024-1019 HIGH
8.6 Jan 30

ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially
CVE-2013-1915 HIGH
7.5 Apr 25

ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cau
CVE-2026-42268 HIGH
8.2 May 12

Remote denial of service in OWASP ModSecurity (libmodsecurity3) 3.0.0 through 3.0.14 allows unauthenticated attackers to

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed

Share

CVE-2026-30923 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy