CVE-2026-73857: ModSecurity v3 XML Request Body Processor Uninitialized Pointer Dereference Vulnerability
owasp-modsecurity · ModSecurity
No distribution fix yet for Debian 12/13 · Affected: owasp-modsecurity ModSecurity · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
Higher than 35% of scored CVEs
DescriptionNVD
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsing_ctx_arg uninitialized in the SAX end-element callback. A single crafted unauthenticated HTTP request can make a worker dereference the pointer, resulting in a constant-value write to an attacker-controlled address. The resulting memory corruption can terminate the worker and may disclose memory or redirect execution. Earlier 3.0.x releases and ModSecurity 2.x do not use the affected path. This issue is fixed in version 3.0.17.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- owasp-modsecurity
- Published
- November 2026
Fix status by distribution
From each distribution’s security tracker. Distributions we did not check are not listed.
- Debian 13Affected, no fix releasedchecked 9 Nov 05:00 UTC
- Debian 12Affected, no fix releasedchecked 9 Nov 05:00 UTC
What changed
Debian status tracked since 9 Nov 2026.
Coverage2 articles · 1 outlet
One row per outlet, in order of first report. First in our coverage: SecurityOnline, 1 Oct.
- Thu 1 Oct, 04:38 UTC. SecurityOnline, first report. ModSecurity Patches Four Flaws That Enable WAF Evasion and Bypass.
- Mon 9 Nov, 05:00 UTC. SecurityOnline. ModSecurity fixes WAF bypass and XML memory flaws.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 1 Oct 04:38 | SecurityOnline | ModSecurity Patches Four Flaws That Enable WAF Evasion and Bypass |
| 9 Nov 05:00 | SecurityOnline | ModSecurity fixes WAF bypass and XML memory flaws |
- ModSecurity fixes WAF bypass and XML memory flawsSecurityOnline · mentions it in passing
- ModSecurity Patches Four Flaws That Enable WAF Evasion and BypassSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.