HighBreach
ModSecurity Patches Two High-Severity Flaws Allowing WAF Bypass and Potential Remote Code Execution
Cyber Security News·Source published ·1 min read
What happened?
Two high-severity flaws have been disclosed in ModSecurity, the open-source web application firewall (WAF) used with Apache, IIS, and Nginx. Two GitHub advisories published by maintainer airween on September 30 describe flaws allowing malicious file uploads and server crashes that could lead to remote code execution. ModSecurity inspects web traffic and blocks requests that look harmful. Many sites depend on it, so any gap in how it reads a request matters.
Key details
- Multiple backend frameworks including Go, Python Flask, FastAPI, Node.js, and Java Spring are vulnerable to this bypass.
- CVE-2026-73857 allows unauthenticated remote users to trigger uninitialized pointer access via crafted XML requests.
- The XML parsing flaw only affects ModSecurity when SecParseXmlIntoArgs is set to On or OnlyArgs, which is Off by default.
Affected
- ModSecurity 3.0.0 and later affected by filename encoding bypass (CVE-2026-104269).
- ModSecurity 3.0.15, 3.0.16, and v3 master affected by XML parsing flaw (CVE-2026-73857).
Fixes and mitigations
- Set SecParseXmlIntoArgs to Off as workaround for XML parsing vulnerability.
- Block script extensions like .php and store uploads outside web root as general defense.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.