CVE-2026-52761 ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture
Attackers can bypass ModSecurity WAF rules on i386 systems due to a buffer size error in the utf8toUnicode transformation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52761?
CVE-2026-52761 is a medium-severity vulnerability in owasp-modsecurity ModSecurity, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 architecture. This issue is fixed in version 3.0.16.
Weakness: CWE-467
Which versions are affected by CVE-2026-52761?
2 open source packages ship an affected version, including modsecurity and modsecurity2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
modsecurity Bitnami | From 3.0.0 | 3.0.16 |
modsecurity2 Bitnami | From 3.0.0 | 3.0.16 |
Products include Owasp Modsecurity.
How do I fix CVE-2026-52761?
Upgrade modsecurity to 3.0.16 or later.
Is CVE-2026-52761 being exploited?
There is no known exploitation of CVE-2026-52761 in the wild and no public exploit code.
Other vulnerabilities in owasp-modsecurity ModSecurity
- CVE-2026-52747 Security feature bypass in ModSecurity
- CVE-2024-1019 WAF bypass of the ModSecurity v3 release line
- CVE-2026-42268 ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators
- CVE-2026-30923 libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings
- CVE-2025-48866 ModSecurity has possible DoS vulnerability in sanitiseArg action
Sources
Also known as BIT-modsecurity-2026-52761, BIT-modsecurity2-2026-52761, DEBIAN-CVE-2026-52761, GHSA-qjgm-7gp4-f8qq, UBUNTU-CVE-2026-52761.