ModSecurity, an open source web application firewall engine, contains a vulnerability in its t:utf8toUnicode transformation function (src/actions/transformations/utf8_to_unicode.cc) for versions 3.0.0 through 3.0.15. On i386 architecture, the snprintf function incorrectly uses sizeof on a char pointer rather than the actual length of the unicode buffer, resulting in wrong output. This misbehavior enables attackers to bypass security rules that rely on this transformation. The issue is resolved in version 3.0.16.

The vulnerability allows bypassing of ModSecurity rules that use the t:utf8toUnicode transformation on i386 architecture. This could lead to reduced effectiveness of the web application firewall in preventing certain attacks, potentially allowing malicious input to pass through undetected. There is no direct impact on confidentiality or availability reported.

Upgrade ModSecurity to version 3.0.16 or later, where this issue is fixed. No other mitigations are indicated. Patch status is confirmed by the vendor advisory specifying the fix in 3.0.16.