owasp-modsecurity vulnerabilities

CVEs per yearBy the year they were published

1. 20255
2. 20268

Newest CVEs

• CVE-2026-104269

  ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)

  owasp-modsecurity · ModSecurity

  High8.6
• CVE-2026-73856

  ModSecurity: Response Body Inspection Bypass

  owasp-modsecurity · ModSecurity

  High8.6
• CVE-2026-61813

  ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download

  owasp-modsecurity · ModSecurity

  Low3.7
• CVE-2026-103932

  ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match

  owasp-modsecurity · ModSecurity

  Medium5.8
• CVE-2026-52747

  ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass

  owasp-modsecurity · ModSecurity

  High8.6
• CVE-2026-52761

  ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture

  owasp-modsecurity · ModSecurity

  Medium5.8
• CVE-2026-42268

  ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators

  owasp-modsecurity · ModSecurity

  High8.2
• CVE-2026-30923

  libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings

  owasp-modsecurity · ModSecurity

  High8.2
• CVE-2025-54571

  ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure

  owasp-modsecurity · ModSecurity

  Medium6.9
• CVE-2025-52891

  ModSecurity empty XML tag causes segmentation fault

  owasp-modsecurity · ModSecurity

  Medium6.5