What’s Vulnerable › Products

owasp-modsecurity ModSecurity vulnerabilities

16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your owasp-modsecurity ModSecurity version is affected

Latest owasp-modsecurity ModSecurity vulnerabilities

• CVE-2026-52761 — ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture (CVSS 5.3)
• CVE-2026-52747 — ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass (CVSS 8.6)
• CVE-2026-42268 — ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators (CVSS 7.5)
• CVE-2026-30923 — libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings (CVSS 7.5)
• CVE-2025-54571 — ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure (CVSS 6.1)
• CVE-2025-52891 — ModSecurity empty XML tag causes segmentation fault (CVSS 6.5)
• CVE-2025-48866 — ModSecurity has possible DoS vulnerability in sanitiseArg action (CVSS 7.5)
• CVE-2024-1019 — WAF bypass of the ModSecurity v3 release line (CVSS 8.6)
• CVE-2023-38285 — (CVSS 7.5)
• CVE-2023-28882 — (CVSS 7.5)
• CVE-2022-48279 — (CVSS 7.5)
• CVE-2021-42717 — (CVSS 7.5)
• CVE-2019-25043 — (CVSS 5.3)
• CVE-2020-15598 — (CVSS 7.5)
• CVE-2019-19886 — (CVSS 7.5)
• CVE-2018-13065 — (CVSS 6.1)