VulnSocial

CVE-2026-42268Exploit(owasp / modsecurity)

LOWCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch owasp modsecurity systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exception (std::out_of_range) caused by unsigned integer underflow in libmodsecurity3 if the user (administrator) uses a rule any of @verifySSN, @verifyCPF, or @verifySVNR. This vulnerability is fixed in 3.0.15.

owasp CVEsBack to dashboard
2.0/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-191CWE-248

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • modsecurity

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Exploit: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-05-01); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
owasp
Products
modsecurity

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-05-01: 1Mentions · 2026-05-12: 1PoC Mentioned / Linked · 2026-05-01: 1Patch / Workaround · 2026-05-01: 1Technical Details · 2026-05-01: 1Technical Details · 2026-05-12: 105-0105-12
Signal classification2 categories
Exploit
150.0%
Disclosure
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-05-011
Exploit1
2026-05-121
Disclosure1
Full discourse2 posts
  • Hunt.io@Huntio
    Exploit

    🚨 One-Line Script Can Crash ModSecurity v3 WAFs https://securityonline.info/libmodsecurity3-dos-vulnerabilities-cve-2026-30923-patch-guide/ Two libmodsecurity3 flaws can put ModSecurity v3 WAF availability at risk. CVE-2026-30923 can crash worker processes with a tiny malformed query string when t:hexDecode is used. The advisory says a simple one-line bash loop can keep crashing workers until legit users have nothing left to connect to. A second bug, CVE-2026-42268, affects rules using verifySSN, verifyCPF, or verifySVNR. libmodsecurity3 3.0.15 includes fixes for both vulnerabilities. #ThreatIntelligence #ModSecurity #CyberSecurity #InfoSec

    Post summary

    The tweet highlights two ModSecurity v3 WAF CVEs that can be exploited with a simple one‑line bash script causing denial‑of‑service, while noting the bugs are patched in version 3.0.15.

    10064920
    6.5K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-42268 ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exce… https://www.cve.org/CVERecord?id=CVE-2026-42268

    Post summary

    The post announces CVE‑2026‑42268, noting it affects ModSecurity versions 3.0.0‑3.0.14 due to an unhandled exception; no exploits, PoC, or patch information is provided.

    0000068
    57.5K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appowaspmodsecurity---

Explore more

Back to dashboardowasp CVEsmodsecurity vulnerabilities