ModSecurity Security Flaws Enable WAF Rule Evasion With Crafted HTTP Requests

Gbhackers •Divya • July 6, 2026

ModSecurity, a widely used open-source web application firewall (WAF), has multiple security vulnerabilities that allow attackers to bypass detection with specially crafted HTTP requests. These vulnerabilities, identified as CVE-2026-52761 and CVE-2026-52747, affect ModSecurity versions up to 3.0.15. They have been addressed in version 3.0.16. These issues reveal significant inconsistencies in input transformation and request parsing, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ModSecurity Vulnerabilities Allow WAF Rule Evasion ModSecurity, an open-source web application firewall, has multiple vulnerabilities (CVE-2026-52761 and CVE-2026-52747) that enable attackers to bypass security rules through specially crafted HTTP requests. These flaws affect versions up to 3.0.15 and were addressed in version 3.0.16. The vulnerabilities stem from inconsistencies in input transformation and request parsing, posing a risk to web applications relying on this firewall for security. Users are advised to upgrade to the latest version to mitigate potential exploitation. The flaws have been classified as moderate severity, indicating a significant but not critical risk. 2 sources 58

Extracted Entities

ModSecurity Security Flaws Enable WAF Rule Evasion With Crafted HTTP Requests

The full story

Extracted Entities

CVEs (2)

MITRE ATT&CK (1)

Platforms (1)