CVE-2026-42268

A flaw was found in ModSecurity, an open-source web application firewall (WAF). This vulnerability occurs when an administrator configures a rule that uses @verifySSN, @verifyCPF, or @verifySVNR functions. An unhandled exception, specifically an unsigned integer underflow, can lead to a denial of service (DoS) condition, making the WAF unavailable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, administrators should avoid configuring ModSecurity rules that utilize the @verifySSN, @verifyCPF, or @verifySVNR functions. Disabling or removing these specific rules will prevent the unsigned integer underflow that leads to a denial of service. After modifying ModSecurity configuration, a service reload or restart may be required for the changes to take effect.