CVE-2026-42268 ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators
An unsigned integer underflow in ModSecurity WAF operators causes an unhandled exception, leading to denial of service when specific rules are configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42268?
CVE-2026-42268 is a high-severity vulnerability in owasp-modsecurity ModSecurity, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exception (std::out_of_range) caused by unsigned integer underflow in libmodsecurity3 if the user (administrator) uses a rule any of @verifySSN, @verifyCPF, or @verifySVNR. This vulnerability is fixed in 3.0.15.
Which versions are affected by CVE-2026-42268?
2 open source packages ship an affected version, including modsecurity and modsecurity2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
modsecurity Bitnami | From 3.0.0 | 3.0.15 |
modsecurity2 Bitnami | From 3.0.0 | 3.0.15 |
Products include Owasp Modsecurity.
How do I fix CVE-2026-42268?
Upgrade modsecurity to 3.0.15 or later.
Is CVE-2026-42268 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42268 exists.
Other vulnerabilities in owasp-modsecurity ModSecurity
- CVE-2026-52747 Security feature bypass in ModSecurity
- CVE-2024-1019 WAF bypass of the ModSecurity v3 release line
- CVE-2026-30923 libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings
- CVE-2025-48866 ModSecurity has possible DoS vulnerability in sanitiseArg action
- CVE-2023-38285 Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity.
Sources
Also known as BIT-modsecurity-2026-42268, BIT-modsecurity2-2026-42268, DEBIAN-CVE-2026-42268, GHSA-vwr3-7x7g-7p9w, UBUNTU-CVE-2026-42268.