Vulnerability · Published May 12, 2026 · Assigned by GitHub_M
CVE-2026-42268ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators
High 8.2
In plain English
A high-severity security flaw in ModSecurity from owasp-modsecurity. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exception (std::out_of_range) caused by unsigned integer underflow in libmodsecurity3 if the user (administrator) uses a rule any of @verifySSN, @verifyCPF, or @verifySVNR. This vulnerability is fixed in 3.0.15.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | modsecurity | 3.0.9-1+deb12u2 | DEBIAN-CVE-2026-42268 |
| Debian:13 | modsecurity | 3.0.14-1+deb13u1 | DEBIAN-CVE-2026-42268 |
| Debian:14 | modsecurity | 3.0.15-1 | DEBIAN-CVE-2026-42268 |
| Ubuntu:22.04:LTS | modsecurity | no fix listed | UBUNTU-CVE-2026-42268 |
| Ubuntu:24.04:LTS | modsecurity | no fix listed | UBUNTU-CVE-2026-42268 |
| Ubuntu:25.10 | modsecurity | no fix listed | UBUNTU-CVE-2026-42268 |
| Ubuntu:26.04:LTS | modsecurity | no fix listed | UBUNTU-CVE-2026-42268 |
| Ubuntu:26.10 | modsecurity | no fix listed | UBUNTU-CVE-2026-42268 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| owasp-modsecurity | ModSecurity | >= 3.0.0, < 3.0.15 |
Weakness: CWE-191, CWE-248 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N