CVE-2026-42268CWE-191CWE-248

ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators

High · published May 12, 2026

CVSS v4.0
8.2
EPSS
0%
Percentile
40.9
In the wild
Unconfirmed
What it is

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exception (std::out_of_range) caused by unsigned integer underflow in libmodsecurity3 if the user (administrator) uses a rule any of @verifySSN, @verifyCPF, or @verifySVNR. This vulnerability is fixed in 3.0.15.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00486 · 40.9th percentile
Weaknesses
CWE-191 · Integer Underflow (Wrap or Wraparound); CWE-248 · Uncaught Exception
Published
2026-05-12T21:40Z
EPSS history
Timeline
  • 12 MAY 21:40Z
    ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators
    cvelistv5