Crashing the Shield: The One-Line Script Taking Down ModSecurity v3 WAFs
ID: 13545b08-b86a-5541-a804-0e7f60cbeffe
STIX ID: report--13545b08-b86a-5541-a804-0e7f60cbeffe
Feed Name: securityonline.info
Threat Score
Security researchers disclosed two significant vulnerabilities in libmodsecurity3 (CVE-2026-30923 — segfault, CVSS 7.5; CVE-2026-42268 — unsigned integer underflow, CVSS 8.2) that can crash ModSecurity v3 worker processes and render WAF protections unavailable. Administrators are advised to update to libmodsecurity3 3.0.15 or apply temporary workarounds (disable t:hexDecode on query strings and disable @verifySSN/@verifyCPF/@verifySVNR rules) until patched.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.