# CVE-2026-30923: OWASP libModSecurity3 denial of service in t:hexDecode transformation

Source: https://junglewise.ai/threats/cve-2026-30923-owasp-libmodsecurity3-denial-of-service-in-t-hexdecode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-30923 · Severity: high · CVSS 7.5 · Published 2026-05-05

ModSecurity is a widely used web application firewall (WAF) that protects web servers like Apache and Nginx from malicious traffic. A flaw in how the firewall processes certain data transformations allows an attacker to crash the firewall's worker processes by sending a specially crafted web request. This results in a denial of service, preventing legitimate users from accessing the protected website until the attack stops and the processes restart.

Technologies: [OWASP Modsecurity](https://junglewise.ai/threats/technologies/modsecurity). Vendors: [OWASP](https://junglewise.ai/threats/vendors/owasp).

## Quick answers

**Is CVE-2026-30923 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30923 being exploited in the wild.

**How severe is CVE-2026-30923?** High severity, with a CVSS score of 7.5, published 5 May 2026.

**Which products and versions are affected?** OWASP Libmodsecurity3 < 3.0.15.

**Is there a fix for CVE-2026-30923?** A patch was published on 2026-04-28: Version 3.0.15 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-30923 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-30923?** Check whether you run OWASP Libmodsecurity3 or OWASP Modsecurity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in libModSecurity3 (ModSecurity v3) due to an out-of-bounds read (CWE-125) in the hex_decode.cc component. When a rule is configured to use the t:hexDecode transformation, the engine fails to properly handle query string parameters containing only a single character. This leads to a segmentation fault in the modsecurity::utils::string::x2c function during processing. A remote, unauthenticated attacker can exploit this by sending repeated HTTP requests with a single-character parameter to crash WAF worker processes, resulting in a denial of service (DoS). This issue is resolved in version 3.0.15; ModSecurity v2 is not affected.

## Affected products

- OWASP libModSecurity3 < 3.0.15

## Timeline

- 2026-04-28: patched: Version 3.0.15 released
- 2026-05-05: advisory: NVD and GitHub advisories published

## References

- [https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.15](https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.15)
- [https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-qrjc-3jpc-3h2g](https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-qrjc-3jpc-3h2g)

## Related threats

- [ModSecurity uninitialized pointer dereference in XML parsing](https://junglewise.ai/threats/cve-2026-73857-modsecurity-is-an-open-source-cross-platform-web-application)
- [ModSecurity htmlEntityDecode rule bypass via incomplete entity handling](https://junglewise.ai/threats/cve-2026-61812-modsecurity-is-an-open-source-cross-platform-web-application)
- [ModSecurity removeComments bypass via adjacent comments](https://junglewise.ai/threats/cve-2026-104259-modsecurity-is-an-open-source-cross-platform-web-application)
- [ModSecurity response body inspection bypass with mixed-case Content-Type](https://junglewise.ai/threats/cve-2026-73856-modsecurity-is-an-open-source-cross-platform-web-application)
- [ModSecurity multipart parser filename precedence bypass](https://junglewise.ai/threats/cve-2026-104269-modsecurity-is-an-open-source-cross-platform-web-application)