Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-73857

Uninitialized pointer write in ModSecurity XML parsing

CVSS 3.1
7.5 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-73857 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

ModSecurity 3.0.15 until 3.0.17 can leave an XML parsing pointer uninitialized when SecParseXmlIntoArgs is On or OnlyArgs. One crafted unauthenticated HTTP request can make a worker write a constant value to an attacker-controlled address. That memory corruption can terminate the worker and may disclose memory or redirect execution. Earlier 3.0.x releases and ModSecurity 2.x do not use this path.

What to do: Upgrade ModSecurity to 3.0.17.

ProductAffectedFixed in
ModSecurityFrom 3.0.15 until 3.0.173.0.17
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsing_ctx_arg uninitialized in the SAX end-element callback. A single crafted unauthenticated HTTP request can make a worker dereference the pointer, resulting in a constant-value write to an attacker-controlled address. The resulting memory corruption can terminate the worker and may disclose memory or redirect execution. Earlier 3.0.x releases and ModSecurity 2.x do not use the affected path. This issue is fixed in version 3.0.17.

Weakness
CWE-787, CWE-824
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories