PT-2026-36537 · Unknown · Libmodsecurity3

Esadcetiner · Published 2026-05-01 · Updated 2026-05-08 · CVE-2026-30923

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions libModSecurity3 versions prior to 3.0.15

Description A segmentation fault occurs when a rule using the t:hexDecode transformation inspects a query string parameter containing a single character. This allows an attacker to crash worker processes, resulting in a denial of service. Service resumes automatically as worker processes recover from the segmentation fault once the attack ceases.

Recommendations Update to version 3.0.15.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BIT-MODSECURITY-2026-30923

BIT-MODSECURITY2-2026-30923

CVE-2026-30923

OPENSUSE-SU-2026:10732-1

Affected Products

Libmodsecurity3

References · 17

• 🔥 https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-qrjc-3jpc-3h2g · Exploit
• https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.15 · Patch
• https://osv.dev/vulnerability/BIT-modsecurity2-2026-30923 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-30923 · Security Note
• https://osv.dev/vulnerability/BIT-modsecurity-2026-30923 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-30923 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-30923 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30923 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10732-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-30923 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-30923 · Vendor Advisory
• https://twitter.com/Huntio/status/2050259009505050648 · Twitter Post
• https://suse.com/security/cve/CVE-2026-42268 · Note
• https://twitter.com/CVEnew/status/2051741653690396797 · Twitter Post
• https://t.me/cveNotify/162530 · Telegram Post