Executive brief
ModSecurity is a web application firewall (WAF) used to protect websites from malicious traffic and attacks. A flaw in how the software processes specific character conversions on 32-bit (i386) systems allows attackers to bypass security rules. This could allow malicious requests that should have been blocked to reach the protected web server, potentially leading to further exploitation of the underlying application.
Technical details
A vulnerability exists in the t:utf8toUnicode transformation within ModSecurity (v3.0.0 through 3.0.15) when running on i386 architecture. The root cause is the incorrect use of 'sizeof()' on a char pointer instead of the actual buffer length in 'src/actions/transformations/utf8_to_unicode.cc'. On 32-bit systems, this results in a 4-byte limit that truncates the Unicode output, whereas on 64-bit systems, the 8-byte pointer size coincidentally matches the buffer size. A remote, unauthenticated attacker can exploit this to craft payloads that bypass WAF rules relying on this transformation. The issue is resolved in version 3.0.16.
Affected products
- OWASP ModSecurity 3.0.0 - 3.0.15
Timeline
- 2026-06-29: patched: Version 3.0.16 released
- 2026-06-29: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: CVE-2026-52761 published to NVD