CVE-2026-42268: owasp-modsecurity modsecurity Integer Underflow (Wrap or Wraparound)
Vulnerability summary
CVE-2026-42268 is a high (CVSS 8.2) Integer Underflow (Wrap or Wraparound) vulnerability in owasp-modsecurity modsecurity. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.4% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 12-05-2026PublishedVulnerability first disclosed.
- 14-05-2026Last modifiedVulnerability information updated.
Description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exception (std::out_of_range) caused by unsigned integer underflow in libmodsecurity3 if the user (administrator) uses a rule any of @verifySSN, @verifyCPF, or @verifySVNR. This vulnerability is fixed in 3.0.15.
CVSS metrics
6 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.49%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
+0.09 pp
From 0.40% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundModsecurity
Maturity: poc
Weaknesses
CWE · root cause- CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
- CWE-248Uncaught ExceptionAn exception is thrown from a function, but it is not caught.
Affected systems
Debian1 product
- modsecurity< 3.0.9-1+deb12u2 | < 3.0.14-1+deb13u1 | < 3.0.15-1
Owasp1 product
- modsecurity≥ 3.0.0, < 3.0.15
Owasp-modsecurity1 product
- modsecurity≥ 3.0.0, < 3.0.15
Ubuntu1 product
- modsecurityAll versions (No fix recorded)
4 vendors · 4 products
References
4 links- github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-vwr3-7x7g-7p9wX Refsource CONFIRMREPORTExploitVendor Advisory
