Denial of Service Vulnerability in Libmodsecurity for Web Application Firewalls

CVE-2026-30923

What is CVE-2026-30923?

Libmodsecurity, a key component of the ModSecurity project, is prone to a denial of service vulnerability. An attacker can exploit a specific rule using the t:hexDecode transformation that inspects a query string with a single character. This exploitation results in a segmentation fault, causing worker processes to crash. Although service is restored once the attack ceases due to automatic recovery from the segmentation fault, it poses a significant risk to web applications relying on this firewall technology. The issue affects all versions prior to 3.0.15, which includes a crucial patch to mitigate this vulnerability.

References