CVE-2026-42268 HIGH

CVE-2026-42268: ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators

Vendor Owasp-Modsecurity
Product ModSecurity
Weakness CWE-191
Published May 12, 2026
Last update May 14, 2026
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exception (std::out_of_range) caused by unsigned integer underflow in libmodsecurity3 if the user (administrator) uses a rule any of @verifySSN, @verifyCPF, or @verifySVNR. This vulnerability is fixed in 3.0.15.

Key dates

02Disclosure timeline

May 12, 2026 CVE published
May 14, 2026 Record updated