owasp-modsecurity ModSecurity up to 3.0.15 Transformation utf8_to_unicode.cc snprintf buffer overflow

Summaryinfo

A vulnerability, which was classified as critical, has been found in owasp-modsecurity ModSecurity up to 3.0.15. Affected by this vulnerability is the function snprintf of the file src/actions/transformations/utf8_to_unicode.cc of the component Transformation. This manipulation causes buffer overflow. This vulnerability is tracked as CVE-2026-52761. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in owasp-modsecurity ModSecurity up to 3.0.15 and classified as critical. Affected by this vulnerability is the function snprintf of the file src/actions/transformations/utf8_to_unicode.cc of the component Transformation. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 architecture. This issue is fixed in version 3.0.16.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-52761 since 06/08/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 3.0.16 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• owasp-modsecurity

Name

• ModSecurity

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.0.11
• 3.0.12
• 3.0.13
• 3.0.14
• 3.0.15

Website

• Product: https://github.com/owasp-modsecurity/ModSecurity/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion