EUVD-2026-43113Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
AC:H because exploitation is contingent on i386 architecture, a deployment condition outside attacker control that substantially limits viable targets.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 architecture. This issue is fixed in version 3.0.16.
AnalysisAI
WAF rule bypass in ModSecurity 3.0.0-3.0.15 on i386 architecture allows network-accessible attackers to evade rules that use the t:utf8toUnicode transformation, potentially permitting injection attacks or other malicious payloads to reach protected applications undetected. The root cause is CWE-467 - sizeof() applied to a char pointer in utf8_to_unicode.cc yields the pointer width (4 bytes on i386) rather than the unicode buffer length, corrupting transformation output. No public exploit code or active exploitation has been identified at time of analysis; the fix is available in v3.0.16.
Technical ContextAI
ModSecurity is a cross-platform WAF engine (CPE: cpe:2.3:a:owasp-modsecurity:modsecurity:*:*:*:*:*:*:*:*) that integrates with Apache, IIS, and Nginx. The vulnerability resides in src/actions/transformations/utf8_to_unicode.cc and is classified as CWE-467 (Use of sizeof() on a Pointer Type). On i386, a char pointer is 4 bytes wide; snprintf incorrectly uses sizeof(pointer) as the buffer size argument instead of the actual unicode buffer length. This produces silently truncated or otherwise malformed output from the t:utf8toUnicode transformation. ModSecurity rules that normalize input using this transformation before matching - a common practice for detecting evasion via UTF-8 encoding tricks - will operate on corrupt data and fail to match attack signatures, creating a detection gap. The bug is architecture-specific: 64-bit and other architectures where pointer size coincidentally matches or exceeds the buffer size are not affected.
RemediationAI
Upgrade ModSecurity to version 3.0.16, which resolves the issue via commit edcd010814e234d46e2ec55a0f1078ff9d3032e4 (https://github.com/owasp-modsecurity/ModSecurity/commit/edcd010814e234d46e2ec55a0f1078ff9d3032e4); the release is available at https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.16. If an immediate upgrade is not feasible on affected i386 systems, a targeted workaround is to audit ModSecurity rule sets and remove or rewrite rules that rely on the t:utf8toUnicode transformation, replacing them with alternative encoding normalization transformations (e.g., t:urlDecodeUni or t:htmlEntityDecode) that are not affected by this bug - note this may reduce coverage for specific UTF-8 evasion patterns. Disabling the transformation globally is also viable but trades detection coverage for stability. Organizations should verify the architecture of their ModSecurity deployments before treating this as urgent.
More in Modsecurity
View allLibmodsecurity is one component of the ModSecurity v3 project. Rated high severity (CVSS 7.9), this vulnerability is rem
ModSecurity versions prior to 2.9.10 contain a denial of service vulnerability in the `sanitiseArg` and `sanitizeArg` ac
ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Rated high severity (CVSS 7.5), this vulnerabi
Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. Rated high severity (CVSS 7.5),
The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver ar
ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. Rated medium severity (CVSS 6.1), this vulnerabili
The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NUL
apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer codi
WAF filtering bypass in OWASP ModSecurity (libmodsecurity) before 3.0.16 lets remote unauthenticated attackers smuggle m
ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cau
Remote denial of service in OWASP ModSecurity (libmodsecurity3) 3.0.0 through 3.0.14 allows unauthenticated attackers to
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today