Is CVE-2026-42268 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42268 being exploited in the wild.

How severe is CVE-2026-42268?

Informational severity, with a CVSS score of 8.2, published 12 May 2026.

Which products and versions are affected?

OWASP Libmodsecurity3 3.0.0 to 3.0.14.

Is there a fix for CVE-2026-42268?

A patch was published on 2026-05-12: Version 3.0.15 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42268 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42268?

Check whether you run OWASP Libmodsecurity3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42268: OWASP ModSecurity denial of service via integer underflow in libmodsecurity3

CVE-2026-42268 · Severity: info · CVSS 8.2 · Published 2026-05-12

ModSecurity is a widely used web application firewall (WAF) that protects websites from malicious traffic. A flaw in how it processes certain data validation rules can allow an attacker to crash the firewall by sending a specially crafted web request. This results in a denial-of-service, potentially leaving the protected website unavailable or unprotected until the service is restarted.

Vendors: OWASP.

Quick answers

Is CVE-2026-42268 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42268 being exploited in the wild.
How severe is CVE-2026-42268?: Informational severity, with a CVSS score of 8.2, published 12 May 2026.
Which products and versions are affected?: OWASP Libmodsecurity3 3.0.0 to 3.0.14.
Is there a fix for CVE-2026-42268?: A patch was published on 2026-05-12: Version 3.0.15 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42268 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42268?: Check whether you run OWASP Libmodsecurity3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unsigned integer underflow exists in libmodsecurity3 versions 3.0.0 through 3.0.14 within the @verifySSN, @verifyCPF, and @verifySVNR operators. When these operators process an empty input string, the expression 'input.size() - 1' wraps to a maximum integer value (SIZE_MAX), causing a loop to execute incorrectly. This leads to a 'std::out_of_range' exception during a substring operation, which is uncaught and results in a process crash (std::terminate). An unauthenticated remote attacker can trigger this by sending a request with an empty parameter that is evaluated by a rule using one of the affected operators. The issue is fixed in version 3.0.15.

Affected products

OWASP libmodsecurity3 3.0.0 to 3.0.14

Timeline

2026-04-28: advisory: GitHub Security Advisory published by maintainers
2026-05-12: disclosed: CVE published to NVD
2026-05-12: patched: Version 3.0.15 released to address the vulnerability

References

https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-vwr3-7x7g-7p9w

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.