Is CVE-2026-52761 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52761 being exploited in the wild.

How severe is CVE-2026-52761?

Medium severity, with a CVSS score of 5.8, published 10 July 2026.

Which products and versions are affected?

OWASP Modsecurity 3.0.0 - 3.0.15.

Is there a fix for CVE-2026-52761?

A patch was published on 2026-06-29: Version 3.0.16 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-52761 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-52761?

Check whether you run OWASP Modsecurity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52761: OWASP ModSecurity WAF rule bypass in utf8toUnicode transformation

CVE-2026-52761 · Severity: medium · CVSS 5.8 · Published 2026-07-10

ModSecurity is a web application firewall (WAF) used to protect websites from malicious traffic and attacks. A flaw in how the software processes specific character conversions on 32-bit (i386) systems allows attackers to bypass security rules. This could allow malicious requests that should have been blocked to reach the protected web server, potentially leading to further exploitation of the underlying application.

Technologies: OWASP Modsecurity. Vendors: OWASP.

Quick answers

Is CVE-2026-52761 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52761 being exploited in the wild.
How severe is CVE-2026-52761?: Medium severity, with a CVSS score of 5.8, published 10 July 2026.
Which products and versions are affected?: OWASP Modsecurity 3.0.0 - 3.0.15.
Is there a fix for CVE-2026-52761?: A patch was published on 2026-06-29: Version 3.0.16 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52761 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-52761?: Check whether you run OWASP Modsecurity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the t:utf8toUnicode transformation within ModSecurity (v3.0.0 through 3.0.15) when running on i386 architecture. The root cause is the incorrect use of 'sizeof()' on a char pointer instead of the actual buffer length in 'src/actions/transformations/utf8_to_unicode.cc'. On 32-bit systems, this results in a 4-byte limit that truncates the Unicode output, whereas on 64-bit systems, the 8-byte pointer size coincidentally matches the buffer size. A remote, unauthenticated attacker can exploit this to craft payloads that bypass WAF rules relying on this transformation. The issue is resolved in version 3.0.16.

Affected products

OWASP ModSecurity 3.0.0 - 3.0.15

Timeline

2026-06-29: patched: Version 3.0.16 released
2026-06-29: advisory: GitHub Security Advisory published
2026-07-10: disclosed: CVE-2026-52761 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.