CVE-2026-30923: 
ModSecurity vulnerability analysis and mitigation

CVE-2026-30923 is a denial-of-service vulnerability in libModSecurity3 (the ModSecurity v3 WAF engine) caused by a segmentation fault triggered when a rule using the t:hexDecode transformation inspects a query string parameter containing a single character. All versions of libModSecurity3 before 3.0.15 are affected; ModSecurity2 for Apache is not affected. The vulnerability was disclosed on April 28, 2026, and patched in v3.0.15 released the same day. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, ModSecurity Release).

The root cause is a buffer overflow / out-of-bounds read (CWE-125) combined with an integer overflow or wraparound (CWE-190) in hex_decode.cc. When the t:hexDecode transformation processes a single-character query string value, the length calculation underflows, causing the xsingle2c and x2c string utility functions to read past the end of the allocated buffer, resulting in a segmentation fault. The backtrace confirms the crash originates in modsecurity::actions::transformations::HexDecode::transform → x2c → xsingle2c at string.h:216. Exploitation requires only that a WAF rule using t:hexDecode on ARGS (or similar query string targets) be active — no authentication or special privileges are needed (GitHub Advisory).

Successful exploitation crashes all ModSecurity worker processes, rendering the WAF unavailable and leaving the protected web application without WAF-based filtering for the duration of the attack. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Worker processes automatically recover once the attack traffic stops, meaning the denial of service is sustained only while the attacker continues sending malicious requests (GitHub Advisory).

A proof-of-concept exploit is publicly available in the official security advisory, consisting of a simple curl command and a one-liner bash loop that continuously sends single-character query string parameters to crash worker processes. The EPSS score is approximately 0.042%, indicating low predicted exploitation probability at this time. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not currently listed in the CISA KEV catalog (GitHub Advisory).

1. Reconnaissance: Identify web servers running libModSecurity3 (any version before 3.0.15) with rules that apply the t:hexDecode transformation to query string parameters (e.g., ARGS). This can be inferred from server headers, error responses, or known deployment patterns.
2. Craft the malicious request: Prepare an HTTP GET request with a single-character query string parameter targeting the parameter name matched by the vulnerable rule (e.g., /?test=a).
3. Send the request: Execute curl "http://target/?test=a" — this triggers the integer underflow in hex_decode.cc, causing xsingle2c to read out of bounds and crash the worker process.
4. Sustain the attack: Run a continuous loop to keep crashing recovering worker processes: while true; do curl "http://target/?test=a"; done — this exhausts all available worker processes and maintains the denial-of-service condition.
5. Effect: The WAF stops processing requests, leaving the backend application unprotected and potentially unavailable, until the attack stops and workers recover (GitHub Advisory).

• Network: High-frequency HTTP GET requests to any endpoint with a single-character query string parameter value (e.g., /?<param>=<single_char>); repeated requests from the same source IP in rapid succession.
• Logs: Web server access logs showing a flood of requests with single-character query string values; ModSecurity audit logs showing abrupt termination or gaps in logging corresponding to worker crashes.
• Process: Repeated segmentation fault signals (SIGSEGV) in worker processes (e.g., Apache httpd, Nginx worker) visible in system logs (/var/log/syslog, /var/log/nginx/error.log, or Apache error_log); entries such as worker process <PID> exited on signal 11 in Nginx error logs.
• System: Core dump files generated in the working directory of the web server process if core dumps are enabled (GitHub Advisory).

Upgrade libModSecurity3 to version 3.0.15 or later, which contains the fix for the buffer overflow in hex_decode.cc (ModSecurity Release). As a temporary workaround prior to patching, disable or modify any WAF rules that apply the t:hexDecode transformation to query string parameters (ARGS or similar targets). FreeBSD users can apply the updated modsecurity3 port, and openSUSE users should apply the vendor-provided security update (GitHub Advisory).

The vulnerability was reported by security researcher EsadCetiner and credited in the official advisory. The HKCERT published a security bulletin on May 7, 2026, highlighting the denial-of-service risk to ModSecurity deployments. The openSUSE security team issued a security announcement, and FreeBSD's VuXML database was updated to track the vulnerability. Community reaction on Bluesky noted the straightforward exploitability of the issue given the public PoC (GitHub Advisory).