Log in Start free

Vulnerability · Published Jul 10, 2026 · Assigned by GitHub_M

CVE-2026-52761ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture

Medium 5.8

In plain English

A medium-severity security flaw in ModSecurity from owasp-modsecurity. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.8Medium
Exploit odds (30 days)0.4%top 64.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 architecture. This issue is fixed in version 3.0.16.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12modsecurityno fix listedDEBIAN-CVE-2026-52761
Debian:13modsecurityno fix listedDEBIAN-CVE-2026-52761
Debian:14modsecurity3.0.16-1DEBIAN-CVE-2026-52761
Ubuntu:22.04:LTSmodsecurityno fix listedUBUNTU-CVE-2026-52761
Ubuntu:24.04:LTSmodsecurityno fix listedUBUNTU-CVE-2026-52761
Ubuntu:26.04:LTSmodsecurityno fix listedUBUNTU-CVE-2026-52761
Ubuntu:26.10modsecurityno fix listedUBUNTU-CVE-2026-52761

Affected products (as reported)

VendorProductVersions
owasp-modsecurity ModSecurity >= 3.0.0, < 3.0.16

Weakness: CWE-467 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

References