CVE-2026-52761
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 architecture. This issue is fixed in version 3.0.16.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
- EPSS probability
- 0.41%
- CWE
- CWE-467
- Published
- 2026-07-10
- Last modified
- 2026-07-13
Affected products
- owasp-modsecurity ModSecurity
Weakness type
Related vulnerabilities
- CVE-2025-33132 — Fixes to common vulnerabilities found in IBM Db2 High Performance Unload
- CVE-2020-1638 — Junos OS & Junos OS Evolved: A specific IPv4 packet can lead to FPC restart.