In OWASP ModSecurity, t:base64DecodeExt discards the entire decoded value (while reporting success) when the input contains a malformed single-character X== padding group anywhere in the string, letting attackers bypass rules that match on the decoded content. The advisory lists 2.9.15 and 3.0.17 as fixed, but those releases only change the base64url -/_ mapping; the padding-wipe check in apache2/msc_util.c and src/utils/base64.cc is unchanged in 2.9.15, 3.0.17 and on v2/master and v3/master as of 2026-10-01, so no fixed version exists.