Which versions of ModSecurity are affected by CVE-2026-42268?

ModSecurity Web Application Firewall versions 3.0.0-3.0.14 can be remotely crashed by any attacker sending a crafted request, leaving web applications unprotected until the WAF service restarts.. A patch is available.

How to fix or mitigate CVE-2026-42268?

Within 24 hours, identify all systems running ModSecurity libmodsecurity3 versions 3.0.0-3.0.14 and determine whether they use the vulnerable rule operators (@verifySSN, @verifyCPF, @verifySVNR). Within 7 days, upgrade all affected instances to ModSecurity 3.0.15, coordinating through change management to avoid unprotected windows during deployment. Within 30 days, verify successful deployment across all environments, review WAF logs for exploitation attempts using the publicly available exploit code, and update asset inventory and compliance records.

ModSecurity CVE-2026-42268

Q: What is the CVSS score of CVE-2026-42268?

CVE-2026-42268 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29854 HIGH

Integer Underflow (CWE-191)

2026-05-12 GitHub_M

Nginx Integer Overflow Information Disclosure Apache Modsecurity

8.2

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because exploitation depends on the non-default @verifySSN/@verifyCPF/@verifySVNR operators being configured; impact is availability-only (A:H, C:N/I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

4.9 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:14 vuln.today

Patch available

May 12, 2026 - 23:03 EUVD

CVSS changed

May 12, 2026 - 22:22 NVD

8.2 (HIGH)

CVE Published

May 12, 2026 - 21:40 nvd

HIGH 8.2

DescriptionGitHub Advisory

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exception (std::out_of_range) caused by unsigned integer underflow in libmodsecurity3 if the user (administrator) uses a rule any of @verifySSN, @verifyCPF, or @verifySVNR. This vulnerability is fixed in 3.0.15.

AnalysisAI

Remote denial of service in OWASP ModSecurity (libmodsecurity3) 3.0.0 through 3.0.14 allows unauthenticated attackers to crash the WAF engine when the deployed rule set uses the @verifySSN, @verifyCPF, or @verifySVNR operators. An unsigned-integer underflow (CWE-191) produces an out-of-range value that throws an unhandled std::out_of_range exception, terminating the process protecting Apache, IIS, or Nginx. Publicly available exploit code exists per the CISA SSVC assessment, though EPSS remains very low (0.04%) and it is not in CISA KEV; fixed in 3.0.15.

Technical ContextAI

ModSecurity is a cross-platform web application firewall engine; libmodsecurity3 is the C++ core library (v3.x) loaded by the ModSecurity connectors for Apache httpd, Microsoft IIS, and Nginx to inspect HTTP traffic against rule sets such as the OWASP Core Rule Set. The flaw is a CWE-191 integer underflow: input processed by the specialized validation operators @verifySSN (US Social Security Number), @verifyCPF (Brazilian taxpayer ID), and @verifySVNR (Austrian social security number) causes an unsigned integer to wrap below zero, yielding a large index used in a bounds-checked container access. That access throws std::out_of_range, which is never caught, crashing the worker. The affected CPE is cpe:2.3:a:owasp-modsecurity:modsecurity:*, and the tags (Integer Overflow, Information Disclosure, Apache, Nginx, Red Hat, Suse) indicate distribution across major Linux WAF deployments, though the confirmed technical impact here is availability, not disclosure.

RemediationAI

Vendor-released patch: upgrade libmodsecurity3 to 3.0.15, which fixes the underflow (see GHSA-vwr3-7x7g-7p9w at https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-vwr3-7x7g-7p9w); rebuild or update the Apache/IIS/Nginx ModSecurity connector against the patched library, and apply the corresponding Red Hat and SUSE package updates where those distributions are used. If immediate patching is not possible, the specific effective workaround is to remove or disable any rules using the @verifySSN, @verifyCPF, or @verifySVNR operators from your active rule set, which fully closes the vulnerable code path; the trade-off is loss of format/checksum validation for those national identifiers, so any data-leak-prevention or input-validation rules relying on them will no longer fire and should be compensated by alternative regex-based rules until the upgrade is completed.