CVE-2026-52761: OWASP ModSecurity Auth Bypass Vulnerability

CVE-2026-52761 Overview

CVE-2026-52761 affects ModSecurity, an open source cross-platform web application firewall (WAF) engine for Apache, IIS, and Nginx. The vulnerability exists in the t:utf8toUnicode transformation implemented in src/actions/transformations/utf8_to_unicode.cc. On i386 architecture, snprintf uses sizeof on a char pointer rather than the length of the unicode buffer. This produces truncated output and allows WAF rules that rely on the transformation to be bypassed. The flaw affects versions 3.0.0 through 3.0.15 and is fixed in version 3.0.16. The issue is classified as [CWE-467] Use of sizeof() on a Pointer Type.

Critical Impact
Attackers can craft UTF-8 encoded payloads that bypass ModSecurity detection rules on 32-bit i386 deployments, undermining WAF protections in front of web applications.

Affected Products

OWASP ModSecurity 3.0.0 through 3.0.15 (i386 architecture)
Deployments using the t:utf8toUnicode transformation in rule sets
Web servers fronted by ModSecurity on 32-bit builds (Apache, IIS, Nginx)

Discovery Timeline

2026-07-10 - CVE-2026-52761 published to the National Vulnerability Database
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-52761

Vulnerability Analysis

The defect resides in the UTF-8 to Unicode transformation logic used by ModSecurity to normalize inputs before rule evaluation. The transformation calls snprintf with a size argument derived from sizeof applied to a char pointer instead of the intended buffer length. On i386, pointers are 4 bytes, so snprintf writes at most 4 bytes into the unicode buffer regardless of the actual character size. This causes multi-byte UTF-8 sequences to be truncated during normalization. Because ModSecurity matches rules against the transformed output, attackers can construct requests whose decoded representation avoids signatures that would otherwise trigger blocking.

Root Cause

The root cause is the incorrect use of sizeof(unicode) where unicode was declared as unsigned char * rather than a fixed-size array. The sizeof operator returns the size of the pointer type on the target architecture instead of the storage backing the pointer. This is a textbook [CWE-467] defect where a developer expected buffer size semantics but received pointer size semantics.

Attack Vector

An attacker sends HTTP requests containing UTF-8 encoded characters that would normally be decoded by the t:utf8toUnicode transformation and matched against WAF rules. On i386 deployments, truncated decoding produces output that fails to match, allowing the request to pass through to the protected application. The vector is network-based and requires no authentication or user interaction.

text

     bool changed = false;
     std::string::size_type count = 0;
     auto bytes_left = input_len;
-    unsigned char unicode[8];
+    char unicode[8] = {0}; /* 5 or 6 bytes for OLD standard unicode character and 1 byte for null terminator */
+                           /* 4 bytes are enough for standard UTF8 + '\0' */
+                           /* result can be only signed char array, so no need to cast later */
 
     /* RFC3629 states that UTF-8 are encoded using sequences of 1 to 4 octets. */
     /* Max size per character should fit in 4 bytes */

Source: ModSecurity GitHub Commit edcd010. The patch replaces the pointer declaration with a fixed-size character array so that sizeof(unicode) correctly returns 8 and snprintf writes the intended number of bytes.

Detection Methods for CVE-2026-52761

Indicators of Compromise

Requests containing multi-byte UTF-8 sequences that bypass WAF rules referencing t:utf8toUnicode on 32-bit ModSecurity instances
ModSecurity audit log entries showing transformed values shorter than expected for known payloads
Successful application-layer attacks against endpoints where ModSecurity rules should have triggered

Detection Strategies

Inventory ModSecurity deployments and identify any running on i386 architecture with versions between 3.0.0 and 3.0.15
Review active rule sets (including OWASP CRS) for uses of t:utf8toUnicode and test with UTF-8 encoded payloads on affected builds
Correlate WAF audit logs with backend application logs to identify requests that reached the origin without triggering expected rule matches

Monitoring Recommendations

Enable full ModSecurity audit logging (SecAuditEngine On) with transformation output captured for post-hoc analysis
Alert on version banners or package metadata reporting ModSecurity 3.0.x below 3.0.16 on 32-bit hosts
Track anomalous UTF-8 heavy requests to sensitive endpoints such as login, search, and API surfaces

How to Mitigate CVE-2026-52761

Immediate Actions Required

Upgrade ModSecurity to version 3.0.16 or later, which contains the fix from commit edcd010
Where immediate upgrade is not possible, migrate 32-bit i386 ModSecurity workloads to 64-bit builds, which are not affected by the sizeof mismatch
Audit rule sets that depend on t:utf8toUnicode and add complementary transformations such as t:urlDecodeUni or t:lowercase to reduce single-transformation dependence

Patch Information

The vendor fix is available in ModSecurity Release v3.0.16. Full technical details are documented in GitHub Security Advisory GHSA-qjgm-7gp4-f8qq. The corrective change declares the transformation buffer as char unicode[8] so that sizeof returns the buffer size rather than a pointer size.

Workarounds

Remove or replace the t:utf8toUnicode transformation in critical WAF rules until the upgrade is applied
Deploy an additional 64-bit ModSecurity or alternative WAF tier in front of affected i386 instances
Restrict inbound traffic on i386 ModSecurity nodes to trusted networks while remediation is in progress

bash

# Verify installed ModSecurity version and architecture
dpkg -l | grep -i modsecurity
uname -m   # Expect x86_64; i386/i686 indicates affected architecture

# Build and install ModSecurity 3.0.16 from source
git clone --depth 1 --branch v3.0.16 https://github.com/owasp-modsecurity/ModSecurity.git
cd ModSecurity
git submodule init && git submodule update
./build.sh && ./configure
make -j$(nproc) && sudo make install