Owasp Modsecurity vulnerabilities

• owasp modsecurity ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass CVE-2026-52747 Fix available 8.6 HighJuly 10, 2026
• owasp modsecurity ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture CVE-2026-52761 Fix available 5.8 MediumJuly 10, 2026
• owasp modsecurity ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators CVE-2026-42268 Fix available 8.2 HighMay 8, 2026
• owasp modsecurity libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings CVE-2026-30923 Fix available 8.2 HighMay 5, 2026
• coreruleset, owasp modsecurity core rule set +1 more OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks CVE-2026-33691 Fix available 6.8 MediumApril 2, 2026
• coreruleset, owasp modsecurity core rule set +1 more OWASP CRS has multipart bypass using multiple content-type parts CVE-2026-21876 Public exploitFix available EPSS 17.3% 9.3 CriticalJanuary 8, 2026
• owasp modsecurity ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure CVE-2025-54571 Fix available 6.9 MediumAugust 5, 2025
• owasp modsecurity ModSecurity has possible DoS vulnerability in sanitiseArg action CVE-2025-48866 Fix available 7.5 HighJune 2, 2025
• owasp modsecurity WAF bypass of the ModSecurity v3 release line CVE-2024-1019 Fix available 8.6 HighJanuary 30, 2024
• owasp modsecurity Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity. CVE-2023-38285 Fix available 7.5 HighJuly 26, 2023
• owasp modsecurity Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash... CVE-2023-28882 Fix available 7.5 HighApril 28, 2023
• owasp modsecurity, debian linux +1 more In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed... CVE-2022-48279 Fix available 7.5 HighJanuary 20, 2023
• owasp modsecurity core rule set, debian linux, fedoraproject fedora +2 more Response body bypass in OWASP ModSecurity Core Rule Set via repeated HTTP Range header submission with a small byte range CVE-2022-39958 Fix available 7.5 HighSeptember 20, 2022
• owasp modsecurity core rule set, debian linux, fedoraproject fedora +2 more Response body bypass in OWASP ModSecurity Core Rule Set via a specialy crafted charset in the HTTP Accept header CVE-2022-39957 Fix available 7.3 HighSeptember 20, 2022
• owasp modsecurity core rule set, debian linux, fedoraproject fedora +2 more Partial rule set bypass in OWASP ModSecurity Core Rule Set for HTTP multipart requests using character encoding in the Content-Type or Content-Transfer-Encoding header CVE-2022-39956 Fix available 7.3 HighSeptember 20, 2022
• owasp modsecurity core rule set, debian linux, fedoraproject fedora +2 more Partial rule set bypass in OWASP ModSecurity Core Rule Set by submitting a specially crafted HTTP Content-Type header CVE-2022-39955 Fix available 7.3 HighSeptember 20, 2022
• debian linux, owasp modsecurity core rule set +1 more Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass... CVE-2020-22669 Fix available 9.8 CriticalSeptember 2, 2022
• owasp modsecurity, debian linux, f5 nginx modsecurity waf +2 more +4 more ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects... CVE-2021-42717 Public exploitFix available 7.5 HighDecember 7, 2021
• owasp modsecurity core rule set, debian linux, fedoraproject fedora +2 more OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is... CVE-2021-35368 Fix available 9.8 CriticalNovember 5, 2021
• owasp modsecurity ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string... CVE-2019-25043 Fix available 5.3 MediumMay 6, 2021
• owasp modsecurity, debian linux +1 more ** DISPUTED ** Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special... CVE-2020-15598 Fix availableDisputed 7.5 HighSeptember 18, 2020
• owasp modsecurity, fedoraproject fedora +1 more Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may,... CVE-2019-19886 Fix available 7.5 HighJanuary 21, 2020
• owasp modsecurity core rule set A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp... CVE-2018-16384 Fix available 7.5 HighSeptember 3, 2018
• owasp modsecurity ** DISPUTED ** ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. NOTE: a... CVE-2018-13065 Disputed 6.1 MediumJuly 3, 2018