ModSecurity Vulnerability Details and PoC Published for WAF Bypass and XML Memory Flaw

TL;DR

The OWASP ModSecurity project has published two advisories with full technical details, and one includes a working proof-of-concept request. These ModSecurity vulnerabilities, CVE-2026-104269 and CVE-2026-73857, can bypass upload rules or corrupt server memory. Both are fixed in libmodsecurity 3.0.17, released on September 29, 2026.

CVE-2026-104269 (CVSS 8.6) lets attackers sneak a dangerous filename past OWASP CRS upload rules. CVE-2026-73857 (CVSS 7.5) can crash a web server worker with one crafted XML request. Upgrade to ModSecurity 3.0.17.

Why It Matters

ModSecurity is the open-source web application firewall engine that runs OWASP CRS rules. When a WAF and the app disagree about a request, attackers win. For the filename flaw, the advisory warns that “the WAF protection is entirely bypassed.”

The security advisory includes a complete proof-of-concept upload request and a table of what each layer sees. The XML advisory, by contrast, describes the bug but ships no exploit. Even so, no exploitation in the wild has been reported for either flaw.

How the Attacks Work

RFC 2231 filename bypass (CVE-2026-104269)

Multipart uploads can carry two filename fields: a plain filename and an encoded filename* value. ModSecurity’s parser read only the plain one. However, backends in Go, Python, Node.js and Java “prefer the RFC 2231 decoded value of filename*.” So an attacker could show the WAF a harmless image name while the app saves a script file. The result could be “RCE if in webroot,” per the advisory. PHP is not affected, since it reads only the plain field. Notably, rules such as CRS 920120, 922100 and 922110 all saw only the harmless name.

XML parser pointer flaw (CVE-2026-73857)

Tobias Klein found that the XML-into-ARGS code dereferences an uninitialized pointer. According to the security advisory, this creates “a restricted write-what-where primitive.” Impact ranges “from denial of service to memory disclosure and execution-flow redirection.” The bug is reachable only when SecParseXmlIntoArgs is set to On or OnlyArgs, and it is Off by default.

Affected Versions

• CVE-2026-104269: ModSecurity 3.0.0 and later, before 3.0.17
• CVE-2026-73857: ModSecurity 3.0.15 and 3.0.16 only
• ModSecurity v2.x and v3 releases before 3.0.15 are not affected by the XML flaw

Patch and Mitigation

• Upgrade libmodsecurity to 3.0.17. It handles filename* and adds new MULTIPART_FILENAME_CHARSET and MULTIPART_FILENAME_LANGUAGE variables.
• Keep SecParseXmlIntoArgs set to Off if you cannot upgrade yet.
• Validate file extensions in the application too, not only at the WAF.

Release 3.0.17 also fixes six other ModSecurity vulnerabilities, including a response body inspection bypass. Therefore, upgrading closes far more than these two flaws.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.