CVE-2026-42268

ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators

State: Published
Severity: 8.2 High
Published: May 12, 2026
Updated: May 14, 2026
Reserved: Apr 26, 2026

Description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exception (std::out_of_range) caused by unsigned integer underflow in libmodsecurity3 if the user (administrator) uses a rule any of @verifySSN, @verifyCPF, or @verifySVNR. This vulnerability is fixed in 3.0.15.

Scores

CVSS	Score	Vector	Source
4.0	8.2 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-191 Integer Underflow (Wrap or Wraparound)
CWE-248 Uncaught Exception

Affected Products

Product	Versions
ModSecurityowasp-modsecurity	>= 3.0.0, < 3.0.15Affected

References

https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-vwr3-7x7g-7p9w

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.