ModSecurity fixes WAF bypass and XML memory flaws

Two ModSecurity vulnerabilities have been disclosed by the OWASP ModSecurity project, with one including a working proof-of-concept for a WAF bypass. CVE-2026-104269 (CVSS 8.6) could let an attacker slip a dangerous filename past upload rules, potentially leading to remote code execution depending on the server backend. CVE-2026-73857 (CVSS 7.5) centres on an XML parser issue that can, in some configurations, write memory or disrupt execution flow.

Both flaws are addressed in libmodsecurity 3.0.17, released on 29 September 2026. The advisory notes the WAF bypass is possible when the RFC 2231 filename\* is decoded by backends (Go, Python, Node, Java) while ModSecurity parsers read only the plain filename; PHP, reading only the plain field, is unaffected.

The XML issue stems from a dereferenced uninitialised pointer in the XML-into-ARGS path, described as a restricted write-what-where primitive with potential impact ranging from denial of service to memory disclosure and execution-flow redirection. The XML flaw is reachable only if SecParseXmlIntoArgs is On or OnlyArgs; it is Off by default.

The affected versions include ModSecurity 3.0.0 and later up to, but not including, 3.0.17 for CVE-2026-104269, and ModSecurity 3.0.15 and 3.0.16 for CVE-2026-73857; ModSecurity v2.x and earlier 3.0.15 releases are not affected by the XML issue. Release 3.0.17 also fixes six other ModSecurity vulnerabilities, including a response body inspection bypass.

Practically, users should upgrade to libmodsecurity 3.0.17 and consider keeping SecParseXmlIntoArgs Off if upgrading isn’t feasible, while continuing to validate file extensions in the application beyond the WAF. The advisories note that there are no confirmed exploitations in the wild at the time of publication. The reporting outlet attributes the findings to the OWASP ModSecurity advisories and to Tobias Klein for the XML issue, with no exploitation claims yet confirmed. The article appears under the author Do Son (SecurityOnline[.]info) dated 9 November 2026.