Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 architecture. This issue is fixed in version 3.0.16.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-06 | 1 | Patch1 |
| 2026-07-13 | 1 | General1 |
| 2026-07-15 | 1 | Disclosure1 |
🟠 ModSecurity WAF, Rule Bypass via Buffer Size Miscalculation, #CVE-2026-52761 (Medium) -DC-Jul2026-965 https://dailycve.com/modsecurity-waf-rule-bypass-via-buffer-size-miscalculation-cve-2026-52761-medium-dc-jul2026-965/
Post summary
The post announces CVE‑2026‑52761, describing a ModSecurity WAF rule bypass caused by a buffer size miscalculation, classified as medium severity, with no PoC, patch, or exploitation details provided.
ModSecurity WAF の脆弱性 CVE-2026-52761／52747 が FIX：検証回避の恐れ https://iototsecnews.jp/2026/07/06/modsecurity-security-flaws-enable-waf-rule-evasion-with-crafted-http-requests/ 今回の WAF の脆弱性は、プログラムの処理における認識のズレが原因となっています。 CVE-2026-52761 では、ポインタ・サイズの誤計算により、 32-bit 環境におけるデータの不適切な処理が発生し、正常な検知ができなくなります。また CVE-2026-52747 では、マルチパート形式のデータを解析する際に、改行コードを不適切に除去してしまうことで、 WAF とバックエンドのシステムとの間でデータの解釈に差異が生まれてしまいます。これらのプログラム内の計算ミスや文字列の不適切な処理という根本的な原因が、セキュリティ・チェックをすり抜ける隙を作っています。ご利用のチームは、ご注意ください。 #CVE202652747 #CVE202652761 #ModSecurity #Vulnerability #WAF
Post summary
The article highlights two ModSecurity rule‑evasion vulnerabilities caused by pointer miscalculations and improper newline handling, but does not provide PoC, exploit tools, patch details, or evidence of active exploitation.
🚨 Two ModSecurity WAF bypass flaws disclosed — patch to v3.0.16 now! 🕳️ CVE-2026-52747 (High, 7.5): The multipart parser strips line breaks from form fields — WAF sees one value, backend sees another. Payloads slip past rules undetected. 🐛 CVE-2026-52761 (Moderate, 5.3): sizeof() on a pointer bug breaks UTF-8 normalization on i386 — rules relying on it can be bypassed. ⬆️ Upgrade immediately + avoid i386 deployments.
Post summary
Two ModSecurity WAF bypass vulnerabilities (CVE-2026-52747 and CVE-2026-52761) have been disclosed, with a patch to v3.0.16 released and immediate upgrade recommended to mitigate the risks.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | owasp | modsecurity | - | - | - |