ModSecurity Flaws Bypass Upload Checks and Crash Workers
First merged summary.
ModSecurity 3.0.0+ has two high-severity flaws allowing upload bypass with no fix and worker crashes when a config is on, fixed in 3.0.17.
Maintainer airween published two GitHub advisories on September 30, 2026 for high-severity ModSecurity flaws affecting Apache, IIS, and Nginx. CVE-2026-104269 in 3.0.0 and later bypasses multipart filename checks, potentially enabling RCE in some backends with no patched version listed. CVE-2026-73857 involves an uninitialized pointer dereference that can crash workers or redirect control flow but only when SecParseXmlIntoArgs is On or OnlyArgs, fixed in 3.0.17.
- CVE-2026-104269 bypasses checks in ModSecurity 3.0.0+; no fix listed
- CVE-2026-73857 crashes workers if SecParseXmlIntoArgs enabled; fixed in 3.0.17
- Affects Apache, IIS, Nginx; PHP native uploads unaffected
- Issues reported by 0xkalawy, ZeyadZonkorany, Tobias Klein on Sep 30, 2026
- Only versions 3.0.15, 3.0.16 and v3 master impacted by second flaw
Timeline
dated events in the reporting · oldest first- Sep 30, 2026Maintainer published two GitHub advisories for ModSecurity · Cyber Security News
- Sep 30, 2026Maintainer published two GitHub advisories for ModSecurity · GBHackers
- Nov 9, 2026Reports published on ModSecurity flaws · Cyber Security News
- Nov 9, 2026Reports published on ModSecurity flaws · GBHackers
What each outlet adds
beyond the shared facts- Cyber Security NewsNames reporters and language preferences
- GBHackersProvides CVSS scores and explicit fixed version
- Vendors
- ModSecurity
- Products
- ModSecurity
- Organizations
- OWASP
Coverage
oldest first · one row per article · UTC- · 2d ago
Cyber Security NewsFirst report
ModSecurity discloses upload-bypass and crash flaws, one unpatched
One flaw has no listed fix; the pointer bug is reachable only if SecParseXmlIntoArgs is On or OnlyArgs.
- · 2d ago
GBHackers
ModSecurity WAF Vulnerability Allows Attackers to Bypass File Upload Restrictions Using Crafted HTTP Requests
Two high-severity flaws in ModSecurity let attackers bypass upload filters or crash server workers with crafted HTTP requests.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-104269 | Multipart filename* mismatch bypass in ModSecurity before 3.0.17 | 8.6 | — | ||
| CVE-2026-73857 | Uninitialized pointer write in ModSecurity XML parsing | 7.5 | — |