WS-2026-0087

In OWASP ModSecurity, t:base64DecodeExt discards the entire decoded value while reporting success when the input contains a malformed single-character X== padding group anywhere in the string, letting attackers bypass rules that match on the decoded content. The advisory lists 2.9.15 and 3.0.17 a...