BSD Portsmodsecurity3 -- multiple vulnerabilities
· CVE-2026-42268, CVE-2026-30923 · VuXML entry
ModSecurity is an open source web application firewall engine. According to the upstream changelog, multiple vulnerabilities have been fixed. CVE-2026-42268: unsigned integer underflow in verify operators CVE-2026-30923: buffer overflow in hex_decode
Affected versions
- modsecurity3 < 3.0.15
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | security/modsecurity3 | 3.0.14 | vulnerable since 2026-05-04 | |
| FreeBSD | security/modsecurity3 | 3.0.17 | fixed | (151 days after) |