ModSecurity Patches Two High-Severity Flaws Allowing WAF Bypass and Potential Remote Code Execution

Two high-severity flaws have been disclosed in ModSecurity, the open-source web application firewall (WAF) used with Apache, IIS, and Nginx.

Two GitHub advisories published by maintainer airween on September 30 describe flaws allowing malicious file uploads and server crashes that could lead to remote code execution.

ModSecurity inspects web traffic and blocks requests that look harmful. Many sites depend on it, so any gap in how it reads a request matters.

CVE-2026-104269 (GHSA-5pww-8rfg-9crf) affects ModSecurity 3.0.0 and later, allowing unauthenticated network attacks that bypass file checks and compromise integrity no patched version is available.

ModSecurity Patches High-Severity Flaws

The problem is a mismatch in how the firewall and the app read an upload. ModSecurity’s multipart parser does not support RFC 2231, a standard for encoded values in headers. Many app frameworks do. When a request holds both a plain filename and an encoded filename*, those frameworks prefer the encoded one.

An attacker can use this by sending filename=”safe.jpg” together with filename*=UTF-8”shell.php. The OWASP Core Rule Set sees a harmless JPG and lets it through. A Go backend reads the name as shell.php and may save it to disk. If the web server serves that folder, the attacker can run code on it.

The advisory says Go, Python (Flask and FastAPI), Node.js, and Java Spring parsers behave this way. PHP’s native upload handling reads only filename=, so it is not affected. Researchers 0xkalawy and ZeyadZonkorany found the issue, and B0YK4 coordinated the report.

The second flaw is CVE-2026-73857 (GHSA-jx3r-phvx-2jmj), reported by researcher Tobias Klein. A single crafted request from an unauthenticated remote user can make a worker process use an uninitialized pointer. That lets the request write a fixed value to an address the sender picks.

The result can be a crash, a memory leak, or a redirect of program flow, which could lead to remote code execution. The weaknesses are listed as CWE-787 (out-of-bounds write) and CWE-824 (access of uninitialized pointer). Its CVSS vector rates the impact as high for availability only, which my calculation puts near 7.5.

The risk is narrower than it sounds. The bug can be reached only when the SecParseXmlIntoArgs setting is On or OnlyArgs. It is Off by default. The code path was added in version 3.0.15, so 3.0.15, 3.0.16, and the current v3 master are affected. Earlier 3.0.x releases and ModSecurity v2 are not.

There is one point to check. The advisory lists 3.0.17 as the patched version, but its text also says a fix is “not yet” available and will come in the next release. Admins should confirm the release on the official project page before assuming they are safe.

For the XML flaw, make sure SecParseXmlIntoArgs is Off, which is the workaround the advisory gives. Then upgrade once you confirm the fixed release.

For the filename flaw, no patch is listed, so do not rely on the WAF alone to judge uploads. Apps should ignore the name sent by the client and create their own safe name. They should also block script extensions such as .php and store uploads outside the web root. These steps are general good practice and are not part of the advisory.

ModSecurity has had other bypass problems recently. Cyber Security News has covered earlier ModSecurity firewall bypass bugs and multiple ModSecurity rule bypass flaws.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post ModSecurity Patches Two High-Severity Flaws Allowing WAF Bypass and Potential Remote Code Execution appeared first on Cyber Security News.