Executive brief
ModSecurity is a widely used web application firewall (WAF) that protects websites from malicious traffic. A flaw in how it processes certain data validation rules can allow an attacker to crash the firewall by sending a specially crafted web request. This results in a denial-of-service, potentially leaving the protected website unavailable or unprotected until the service is restarted.
Technical details
An unsigned integer underflow exists in libmodsecurity3 versions 3.0.0 through 3.0.14 within the @verifySSN, @verifyCPF, and @verifySVNR operators. When these operators process an empty input string, the expression 'input.size() - 1' wraps to a maximum integer value (SIZE_MAX), causing a loop to execute incorrectly. This leads to a 'std::out_of_range' exception during a substring operation, which is uncaught and results in a process crash (std::terminate). An unauthenticated remote attacker can trigger this by sending a request with an empty parameter that is evaluated by a rule using one of the affected operators. The issue is fixed in version 3.0.15.
Affected products
- OWASP libmodsecurity3 3.0.0 to 3.0.14
Timeline
- 2026-04-28: advisory: GitHub Security Advisory published by maintainers
- 2026-05-12: disclosed: CVE published to NVD
- 2026-05-12: patched: Version 3.0.15 released to address the vulnerability