Two high-severity flaws have been disclosed in ModSecurity, the open-source web application firewall (WAF) used with Apache, IIS, and Nginx. Two GitHub advisories published by maintainer airween on September 30 describe flaws allowing malicious file uploads and server crashes that could lead to remote code execution. ModSecurity inspects web traffic and blocks requests that look harmful. Many sites depend on it, so any gap in how it reads a request matters. CVE-2026-104269 (GHSA-5pww-8rfg-9crf) affects ModSecurity 3.0.0 and later, allowing unauthenticated network attacks that bypass file checks and compromise integrity no patched version is available. ModSecurity Patches High-Severity Flaws The problem is a mismatch in how the firewall and the app read an upload. ModSecurity’s multipart parser does not support RFC 2231, a standard for encoded values in headers. Many app frameworks do. When a request holds both a plain filename and an encoded filename*, those frameworks prefer the encoded one. An attacker can use this by sending filename=”safe.jpg” together with filename*=UTF-8”shell.php. The OWASP Core Rule Set sees a harmless JPG and lets it through. A Go backend reads the name as shell.php and may save it to disk. If the web server serves that folder, the attacker can run code on it. The advisory says Go, Python (Flask and FastAPI), Node.js, and Java Spring parsers behave this way. PHP’s native upload handling reads only filename=, so it is not affected. Researchers 0xkalawy and ZeyadZonkorany found the issue, and B0YK4 coordinated the report. The second flaw is CVE-2026-73857 (GHSA-jx3r-phvx-2jmj) , reported by researcher Tobias Klein. A single crafted request from an unauthenticated remote user can make a worker process use an uninitialized pointer. That lets the request write a fixed value to an address the sender picks. The result can be a crash, a memory leak, or a redirect of program flow, which could lead to remote code execution . The weaknesses are listed as CWE-787 (out-of-bounds write) and CWE-824 (access of uninitialized pointer). Its CVSS vector rates the impact as high for availability only, which my calculation puts near 7.5. The risk is narrower than it sounds. The bug can be reached only when the SecParseXmlIntoArgs setting is On or OnlyArgs. It is Off by default. The code path was added in version 3.0.15, so 3.0.15, 3.0.16, and the current v3 master are affected. Earlier 3.0.x releases and ModSecurity v2 are not. There is one point to check. The advisory lists 3.0.17 as the patched version, but its text also says a fix is “not yet” available and will come in the next release. Admins should confirm the release on the official project page before assuming they are safe. For the XML flaw, make sure SecParseXmlIntoArgs is Off, which is the workaround the advisory gives. Then upgrade once you confirm the fixed release. For the filename flaw, no patch is listed, so do not rely on the WAF alone to judge uploads. Apps should ignore the name sent by the client and create their own safe name. They should also block script extensions such as .php and store uploads outside the web root. These steps are general good practice and are not part of the advisory. ModSecurity has had other bypass problems recently. Cyber Security News has covered earlier ModSecurity firewall bypass bugs and multiple ModSecurity rule bypass flaws . Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post ModSecurity Patches Two High-Severity Flaws Allowing WAF Bypass and Potential Remote Code Execution appeared first on Cyber Security News .

OWASP ModSecurity reported two high-severity WAF flaws that could bypass filename checks and crash servers, enabling remote code execution.

Two high-severity flaws in the open-source ModSecurity web application firewall (WAF) let attackers slip past upload filters or crash server workers with a single crafted HTTP request. Maintainers published…

A high-severity vulnerability in ModSecurity could allow attackers to bypass Web Application Firewall (WAF) protections and upload executable files disguised as harmless images. Tracked as CVE-2026-104269 (GHSA-5pww-8rfg-9crf), the flaw exploits differences between how ModSecurity and backend applications interpret multipart file-upload requests. The vulnerability carries a CVSS 3.1 score of 8.6, requires no authentication or user interaction, and affects all ModSecurity 3.x releases starting from version 3.0.0.

TL;DR The OWASP ModSecurity project has published two advisories with full technical details, and one includes a working proof-of-concept request. These ModSecurity vulnerabilities, CVE-2026-104269 and CVE-2026-73857, can bypass upload rules or corrupt server memory. Both are fixed in libmodsecurity 3.0.17, released on September 29, 2026. CVE-2026-104269 (CVSS 8.6) lets attackers sneak a dangerous filename past OWASP CRS upload rules. CVE-2026-73857 (CVSS 7.5) can crash a web server worker with one crafted XML request.

ModSecurityに、深刻度「高」のパーサー差異の脆弱性が見つかりました。この脆弱性は「CVE-2026-104269」（GHSA-5pww-8rfg-9crf）として追跡されており、攻撃者は実行可能ファイルのアップロードを、OWASP Core Rule Set（CRS）のファイル名検査をすり抜けて送り込めます

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can therefore be treated as …

オープンソースのWebアプリケーションファイアウォール（WAF）「ModSecurity」で、深刻度「高」の脆弱性が2件見つかりました。攻撃者は細工したHTTPリクエストを1回送るだけで、アップロードフィルターをすり抜けたり、サーバーのワーカープロセスをクラッシュさせたりできます。メンテナーは2026年9月30日に両

Can NGINX mitigate PHP2Shell (CVE-2026-109618, CVE-2026-109619)? Partly. Tested configs for blocking multipart and filtering uploads with ModSecurity, and why only patched PHP fixes it.