Medium severity · published Jul 10, 2026
CVE-2026-52761
ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 architecture. This issue is fixed in version 3.0.16.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
ModSecurity · owasp-modsecurity
>= 3.0.0, < 3.0.16 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-52761
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-52761
Patch
https://github.com/owasp-modsecurity/ModSecurity/commit/edcd010814e234d46e2ec55a0f1078ff9d3032e4
Product
https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.16
Vendor Advisory
https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-qjgm-7gp4-f8qq
More from ModSecurity
8.6
CVE-2026-52747
ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass
7.5
CVE-2026-42268
ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators
7.5
CVE-2026-30923
libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings