CVE-2026-30923

HIGH EPSS 34.8%
Published May 5, 20261mo ago · Modified Jun 17, 20261w ago
8.2 CVSS 4.0
High
Find Similar
Published May 5, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago

Description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Libmodsecurity is one component of the ModSecurity v3 project. A segmentation fault occurs when a rule using the t:hexDecode transformation inspects a query string parameter containing a single character. An attacker can exploit this to crash worker processes, causing a denial of service. Service resumes once the attack stops as worker processes recover from the segfault. All versions before 3.0.15 of libModSecurity3 are affected. This has been patched in version 3.0.15.

CVSS Details

Base Score
8.2
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
34.8% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-125 Out-of-bounds Read Memory Safety

Affected Products 1

VendorProductVersionRange
owaspmodsecurity* <3.0.15

References 2

  • github.com https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.15
    PatchProduct
  • github.com https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-qrjc-3jpc-3h2g
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.15
    PatchProduct