CVE-2026-52761: ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8tounicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 architecture. This issue is fixed in version 3.0.16.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ModSecurity (transformation utf8toUnicode)to a version that resolves this vulnerability.Fixed in 3.0.16
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52761?
The severity of CVE-2026-52761 is rated medium with a score of 5.8.
How do I fix CVE-2026-52761?
To fix CVE-2026-52761, upgrade ModSecurity to version 3.0.16 or later.
Which versions of ModSecurity are affected by CVE-2026-52761?
ModSecurity versions from 3.0.0 to 3.0.15 are affected by CVE-2026-52761.
What impact does CVE-2026-52761 have on i386 architecture?
CVE-2026-52761 causes the utf8toUnicode transformation to produce incorrect output on i386 architecture.
Is the CVE-2026-52761 vulnerability exploitative?
CVE-2026-52761 is considered low risk as it does not allow for remote code execution.