This vulnerability is caused by an unsigned integer underflow that results in an unhandled std::out_of_range exception within libmodsecurity3. When a rule containing @verifySSN, @verifyCPF, or @verifySVNR is evaluated, the exception can crash the ModSecurity engine, causing the protected web server to become unavailable. The weakness aligns with underflow failures (CWE-191) and unhandled exceptions (CWE-248), potentially disrupting service for any application using the affected rules.

The flaw exists in ModSecurity version 3.0.0 up to, but not including, 3.0.15, a cross‑platform web application firewall used with Apache, IIS, and Nginx. Systems running any of the affected ModSecurity 3.0.x releases are potentially impacted.

The CVSS score of 8.2 classifies the issue as High severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through an administrator who loads rules containing the vulnerable operators; local or privileged access is required to insert or modify rule files, making the situation an internal risk that can lead to denial of service if exploited.