CVE-2026-30923
Reported by github_m · Published May 5, 2026
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Libmodsecurity is one component of the ModSecurity v3 project. A segmentation fault occurs when a rule using the t:hexDecode transformation inspects a query string parameter containing a single character. An attacker can exploit this to crash worker processes, causing a denial of service. Service resumes once the attack stops as worker processes recover from the segfault. All versions before 3.0.15 of libModSecurity3 are affected. This has been patched in version 3.0.15.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| owasp-modsecurity | ModSecurity | < 3.0.15 |
| owasp-modsecurity | ModSecurity | 0 |
Timeline
- Apr 28, 2026 CVE Published
- May 5, 2026 PoC Published
- May 18, 2026 EPSS Score (30 in total, the first dated here)
- Jul 25, 2026 CVE Updated
- Aug 4, 2026 Coalition ESS Score
- Aug 11, 2026 Security Advisory (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-30923
vulnetix vdb fixes CVE-2026-30923Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-30923/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart