Multiple vulnerabilities have been disclosed in OWASP ModSecurity, a widely used open-source web application firewall (WAF), allowing attackers to bypass security rules under specific conditions.
The flaws, tracked as CVE-2026-52761 and CVE-2026-52747, affect ModSecurity versions up to 3.0.15 and have been addressed in version 3.0.16.
The first issue, CVE-2026-52761, is a moderate-severity flaw that impacts the utf8toUnicode transformation on i386 (32-bit) systems.
This transformation is commonly used in ModSecurity rules to normalize input before inspection. Due to an incorrect use of the sizeof() operator on a pointer type, the transformation produces truncated or incorrect output on 32-bit architectures.
Specifically, the code mistakenly calculates the size of a pointer instead of the actual buffer length, resulting in only 4 bytes being processed instead of the intended size.
On 64-bit systems, this bug remains largely unnoticed because the pointer size (8 bytes) coincidentally matches the expected buffer size. However, on i386 systems, this results in inconsistent transformations, enabling attackers to craft payloads that evade detection.
Any security rule that relies on this transformation may fail to inspect malicious input, effectively bypassing firewall protections.
ModSecurity Vulnerabilities
Researchers have confirmed that this issue stems from improper buffer handling in multiple locations within the transformation code. The recommended workaround is to avoid using ModSecurity on i386 systems until patches are fully applied.
The second vulnerability, CVE-2026-52747, is more severe and has been rated as high due to its direct impact on request inspection integrity.
This flaw exists in the multipart/form-data parser within libmodsecurity. It occurs when processing non-file-form fields that contain embedded line breaks, such as carriage-return and line-feed sequences.
Instead of preserving these line breaks, the parser silently removes them before passing the data to ModSecurity rules.
As a result, a payload like “A\r\nB” or “A\nB” is transformed into “AB” during inspection. However, backend applications typically retain the original formatting, creating a mismatch between what the firewall sees and what the application processes.
This discrepancy allows attackers to hide malicious input that depends on line breaks, such as certain injection payloads or parser-specific exploits.
Further analysis shows that the issue is caused by a logic error: previously buffered data is overwritten rather than appended during multipart parsing.
Even more concerning is that ModSecurity’s built-in strict validation mechanisms fail to detect this anomaly. Key indicators, such as MULTIPART_STRICT_ERROR, remain unset, allowing the malicious input to pass through without triggering alerts.
A proof-of-concept demonstration confirmed that both carriage return and newline characters are consistently stripped while validation checks remain clear.
This makes the vulnerability particularly dangerous in real-world deployments where ModSecurity acts as a security boundary in front of web applications.
Security experts recommend upgrading to version 3.0.16 immediately, which includes fixes for both vulnerabilities.
Additionally, organizations should review rulesets that rely on input transformations and multipart parsing to ensure they behave as expected under different input conditions.
These vulnerabilities highlight the risks of parser inconsistencies and architecture-specific bugs in security tools. Even widely trusted defenses like ModSecurity can introduce blind spots if input handling is not carefully validated across all environments.
