# CVE-2026-42268: OWASP ModSecurity denial of service via integer underflow in libmodsecurity3

Source: https://junglewise.ai/threats/cve-2026-42268-owasp-modsecurity-denial-of-service-via-integer-underflow-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-42268 · Severity: info · CVSS 8.2 · Published 2026-05-12

ModSecurity is a widely used web application firewall (WAF) that protects websites from malicious traffic. A flaw in how it processes certain data validation rules can allow an attacker to crash the firewall by sending a specially crafted web request. This results in a denial-of-service, potentially leaving the protected website unavailable or unprotected until the service is restarted.

Vendors: [OWASP](https://junglewise.ai/threats/vendors/owasp).

## Quick answers

**Is CVE-2026-42268 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42268 being exploited in the wild.

**How severe is CVE-2026-42268?** Informational severity, with a CVSS score of 8.2, published 12 May 2026.

**Which products and versions are affected?** OWASP Libmodsecurity3 3.0.0 to 3.0.14.

**Is there a fix for CVE-2026-42268?** A patch was published on 2026-05-12: Version 3.0.15 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42268 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42268?** Check whether you run OWASP Libmodsecurity3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unsigned integer underflow exists in libmodsecurity3 versions 3.0.0 through 3.0.14 within the @verifySSN, @verifyCPF, and @verifySVNR operators. When these operators process an empty input string, the expression 'input.size() - 1' wraps to a maximum integer value (SIZE_MAX), causing a loop to execute incorrectly. This leads to a 'std::out_of_range' exception during a substring operation, which is uncaught and results in a process crash (std::terminate). An unauthenticated remote attacker can trigger this by sending a request with an empty parameter that is evaluated by a rule using one of the affected operators. The issue is fixed in version 3.0.15.

## Affected products

- OWASP libmodsecurity3 3.0.0 to 3.0.14

## Timeline

- 2026-04-28: advisory: GitHub Security Advisory published by maintainers
- 2026-05-12: disclosed: CVE published to NVD
- 2026-05-12: patched: Version 3.0.15 released to address the vulnerability

## References

- [https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-vwr3-7x7g-7p9w](https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-vwr3-7x7g-7p9w)

## Related threats

- [OWASP libModSecurity3 denial of service in t:hexDecode transformation](https://junglewise.ai/threats/cve-2026-30923-owasp-libmodsecurity3-denial-of-service-in-t-hexdecode)