CVE-2026-52761
published 2026-07-10CVE-2026-52761: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.41%
33.8th percentile
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 architecture. This issue is fixed in version 3.0.16.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mod_security | mod_security | — | — |
| owasp-modsecurity | modsecurity | — | — |
| owasp | modsecurity | 3.0.0 – 3.0.15 | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ModSecurity: ModSecurity: Web Application Firewall rules bypass due to incorrect UTF-8 to Unicode transformation
vendor_redhat·2026-07-10·CVSS 5.8
CVE-2026-52761 [MEDIUM] CWE-131 ModSecurity: ModSecurity: Web Application Firewall rules bypass due to incorrect UTF-8 to Unicode transformation
ModSecurity: ModSecurity: Web Application Firewall rules bypass due to incorrect UTF-8 to Unicode transformation
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 architecture. This issue is fixed in version 3.0.16.
A flaw was found in ModSecurity, an open-source web application firewall (WAF). The `t:utf8toUnicode` transformation function, responsible for converting UTF-8 encoded characters to Unicode, generates incor
VulDB
owasp-modsecurity ModSecurity up to 3.0.15 Transformation utf8_to_unicode.cc snprintf buffer overflow
vuldb·2026-07-11·CVSS 5.8
CVE-2026-52761 [MEDIUM] owasp-modsecurity ModSecurity up to 3.0.15 Transformation utf8_to_unicode.cc snprintf buffer overflow
A vulnerability classified as critical was found in owasp-modsecurity ModSecurity up to 3.0.15. Affected is the function snprintf of the file src/actions/transformations/utf8_to_unicode.cc of the component Transformation. The manipulation results in buffer overflow.
This vulnerability is identified as CVE-2026-52761. The attack can be executed remotely. There is not any exploit available.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-52761 mod_security: ModSecurity: Web Application Firewall rules bypass due to incorrect UTF-8 to Unicode transformation [fedora-all]
bugzilla·2026-07-11·CVSS 5.8
CVE-2026-52761 [MEDIUM] CVE-2026-52761 mod_security: ModSecurity: Web Application Firewall rules bypass due to incorrect UTF-8 to Unicode transformation [fedora-all]
CVE-2026-52761 mod_security: ModSecurity: Web Application Firewall rules bypass due to incorrect UTF-8 to Unicode transformation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 archit
Bugzilla
CVE-2026-52761 libmodsecurity: ModSecurity: Web Application Firewall rules bypass due to incorrect UTF-8 to Unicode transformation [epel-all]
bugzilla·2026-07-11·CVSS 5.8
CVE-2026-52761 [MEDIUM] CVE-2026-52761 libmodsecurity: ModSecurity: Web Application Firewall rules bypass due to incorrect UTF-8 to Unicode transformation [epel-all]
CVE-2026-52761 libmodsecurity: ModSecurity: Web Application Firewall rules bypass due to incorrect UTF-8 to Unicode transformation [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 archit
Bugzilla
CVE-2026-52761 libmodsecurity: ModSecurity: Web Application Firewall rules bypass due to incorrect UTF-8 to Unicode transformation [fedora-all]
bugzilla·2026-07-11·CVSS 5.8
CVE-2026-52761 [MEDIUM] CVE-2026-52761 libmodsecurity: ModSecurity: Web Application Firewall rules bypass due to incorrect UTF-8 to Unicode transformation [fedora-all]
CVE-2026-52761 libmodsecurity: ModSecurity: Web Application Firewall rules bypass due to incorrect UTF-8 to Unicode transformation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 arch
Bugzilla
CVE-2026-52761 mod_security: ModSecurity: Web Application Firewall rules bypass due to incorrect UTF-8 to Unicode transformation [epel-all]
bugzilla·2026-07-11·CVSS 5.8
CVE-2026-52761 [MEDIUM] CVE-2026-52761 mod_security: ModSecurity: Web Application Firewall rules bypass due to incorrect UTF-8 to Unicode transformation [epel-all]
CVE-2026-52761 mod_security: ModSecurity: Web Application Firewall rules bypass due to incorrect UTF-8 to Unicode transformation [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 architec
Bugzilla
CVE-2026-52761 ModSecurity: ModSecurity: Web Application Firewall rules bypass due to incorrect UTF-8 to Unicode transformation
bugzilla·2026-07-10·CVSS 5.8
CVE-2026-52761 [MEDIUM] CVE-2026-52761 ModSecurity: ModSecurity: Web Application Firewall rules bypass due to incorrect UTF-8 to Unicode transformation
CVE-2026-52761 ModSecurity: ModSecurity: Web Application Firewall rules bypass due to incorrect UTF-8 to Unicode transformation
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 architecture. This issue is fixed in version 3.0.16.
Hackernews
⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
blogs_hackernews·2026-07-13
CVE-2026-50746 ⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
Somewhere right now, a security tool is quietly finding bugs faster than any human can fix them. That's supposed to be the good news. The catch is that the attackers have the same tools, pointed the other way, and they don't file tickets.
That's the shape of this week. Trusted code turns on the people who installed it. Old bugs from last year are still landing because the fix sat in a queue too long. Fake installers, poisoned packages, systems left facing the open internet, and helpful little AI assistants running instructions that were
2026-07-10
Published