CVE-2026-30923Exploit(owasp / modsecurity)

MEDIUMCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch owasp modsecurity systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Libmodsecurity is one component of the ModSecurity v3 project. A segmentation fault occurs when a rule using the t:hexDecode transformation inspects a query string parameter containing a single character. An attacker can exploit this to crash worker processes, causing a denial of service. Service resumes once the attack stops as worker processes recover from the segfault. All versions before 3.0.15 of libModSecurity3 are affected. This has been patched in version 3.0.15.

owasp CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.15

Exploit / PoC references

Weakness type (CWE)

CWE-125

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

modsecurity

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 2 signals
General: 1 classified signal
Peaked 2d ago at 2 mentions (2026-05-01); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

owasp

Products

modsecurity

Deep dive

Activity timeline4 mentions / 3d

Signal classification4 categories

Exploit

125.0%

Patch

125.0%

General

125.0%

Disclosure

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-01	2	Exploit1Patch1
2026-05-05	1	General1
2026-05-06	1	Disclosure1

Full discourse4 posts

Hunt.io@Huntio161d
Exploit
🚨 One-Line Script Can Crash ModSecurity v3 WAFs https://securityonline.info/libmodsecurity3-dos-vulnerabilities-cve-2026-30923-patch-guide/ Two libmodsecurity3 flaws can put ModSecurity v3 WAF availability at risk. CVE-2026-30923 can crash worker processes with a tiny malformed query string when t:hexDecode is used. The advisory says a simple one-line bash loop can keep crashing workers until legit users have nothing left to connect to. A second bug, CVE-2026-42268, affects rules using verifySSN, verifyCPF, or verifySVNR. libmodsecurity3 3.0.15 includes fixes for both vulnerabilities. #ThreatIntelligence #ModSecurity #CyberSecurity #InfoSec
Post summary
The post warns that a one‑line bash script can crash ModSecurity v3 WAFs via CVE‑2026‑30923 and CVE‑2026‑42268, offers specific exploit details, and notes that version 3.0.15 provides a patch.
10064920
6.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds156d
Disclosure
CVE-2026-30923 Denial of Service via Segmentation Fault in libModSecurity3 Before 3.0.15 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-30923
Post summary
The post announces CVE‑2026‑30923 as a denial‑of‑service vulnerability in libModSecurity3 versions prior to 3.0.15, without mentioning PoC code, exploit tools, active exploitation, or patches.
0000048
4.0K followersView on X
CVE@CVEnew157d
General
CVE-2026-30923 ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Libmodsecurity is one component of the ModSecurity v3 p… https://www.cve.org/CVERecord?id=CVE-2026-30923
Post summary
The entry simply links to the CVE record and mentions the product ModSecurity without providing any technical details, PoC, exploit, or mitigation information.
00000140
57.4K followersView on X
Autumn Good@autumn_good_35161d
Patch
『You are not affected if you use mod_security2. The vulnerabilities only affect libmodsecurity3.』 About CVE 2026-30923 and 2026-42268 | Modsecurity Project https://modsecurity.org/20260428/about-cve-2026-30923-and-2026-42268/
Post summary
The advisory clarifies that users of mod_security2 are not affected, as the CVEs only impact libmodsecurity3, offering a clear mitigation path.
00000423
6.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	owasp	modsecurity	-	-	-

Explore more

Back to dashboard owasp CVEs modsecurity vulnerabilities

What researchers are saying

CVE-2026-30923

Hunt.io[verified]@HuntioExploit

The post warns that a one‑line bash script can crash ModSecurity v3 WAFs via CVE‑2026‑30923 and CVE‑2026‑42268, offers specific exploit details, and notes that version 3.0.15 provides a patch.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces CVE‑2026‑30923 as a denial‑of‑service vulnerability in libModSecurity3 versions prior to 3.0.15, without mentioning PoC code, exploit tools, active exploitation, or patches.

CVE@CVEnewGeneral

The entry simply links to the CVE record and mentions the product ModSecurity without providing any technical details, PoC, exploit, or mitigation information.

Autumn Good@autumn_good_35Patch

The advisory clarifies that users of mod_security2 are not affected, as the CVEs only impact libmodsecurity3, offering a clear mitigation path.