A single‑character query string processed with the t:hexDecode transformation triggers an invalid memory access in libModSecurity3, causing the worker process to crash. The crash results in a temporary service interruption until the worker recovers. The weakness is a classic out‑of‑bounds read, classified as CWE‑125.

All installations of ModSecurity v3 using the libModSecurity3 component on Apache, IIS, or Nginx are affected. Versions before 3.0.15 are vulnerable, regardless of other configuration settings beyond the transformation.

The CVSS score of 8.2 indicates high severity, and the absence of an EPSS rating means the exploitation probability is not quantified at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: an attacker can submit a specially crafted single‑character query string to any ModSecurity‑protected web application. It is inferred that the attack requires no authentication or privileged state, and it does not compromise the confidentiality or integrity of data—only causing a denial of service by crashing worker processes.