Owasp-modsecurity vulnerabilities

Products

• Modsecurity 14

Newest

• owasp-modsecurity modsecurity ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java) CVE-2026-104269 8.6 HighOctober 6, 2026
• owasp-modsecurity modsecurity ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match CVE-2026-103932 5.8 MediumOctober 6, 2026
• owasp-modsecurity modsecurity ModSecurity: Response Body Inspection Bypass CVE-2026-73856 8.6 HighOctober 2, 2026
• owasp-modsecurity modsecurity ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download CVE-2026-61813 3.7 LowOctober 2, 2026
• owasp modsecurity ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass CVE-2026-52747 Fix available 8.6 HighJuly 10, 2026
• owasp modsecurity ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture CVE-2026-52761 Fix available 5.8 MediumJuly 10, 2026
• owasp modsecurity ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators CVE-2026-42268 Fix available 8.2 HighMay 8, 2026
• owasp modsecurity libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings CVE-2026-30923 Fix available 8.2 HighMay 5, 2026
• owasp modsecurity ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure CVE-2025-54571 Fix available 6.9 MediumAugust 5, 2025
• owasp-modsecurity modsecurity ModSecurity empty XML tag causes segmentation fault CVE-2025-52891 Fix available 6.5 MediumJuly 2, 2025
• owasp modsecurity ModSecurity has possible DoS vulnerability in sanitiseArg action CVE-2025-48866 Fix available 7.5 HighJune 2, 2025
• owasp-modsecurity modsecurity ModSecurity Has Possible DoS Vulnerability CVE-2025-47947 Public exploitFix available 7.5 HighMay 21, 2025
• owasp-modsecurity modsecurity Libmodsecurity3 has possible bypass of encoded HTML entities CVE-2025-27110 Fix available 7.9 HighFebruary 25, 2025
• owasp modsecurity WAF bypass of the ModSecurity v3 release line CVE-2024-1019 Fix available 8.6 HighJanuary 30, 2024