On November 5, 2026, two high-severity vulnerabilities in ModSecurity were disclosed. These vulnerabilities are identified as CVE-2026-104269 and CVE-2026-73857, affecting different versions of the software.
CVE-2026-104269 allows attackers to bypass file upload restrictions due to a parser mismatch in the multipart parser. This vulnerability affects ModSecurity versions 3.0.0 and later, but earlier than 3.0.17. The flaw can lead to remote code execution if an attacker sends a crafted HTTP request. Proof-of-concept exploit code for this vulnerability is publicly available, confirming its exploitation.
CVE-2026-73857 involves an uninitialized pointer dereference that could lead to denial of service or memory disclosure. This vulnerability affects ModSecurity versions 3.0.15 and 3.0.16.
Administrators are urged to upgrade to version 3.0.17 and implement server-side validation for file uploads to mitigate these vulnerabilities. The issues highlight the parser-differential problem seen in web application firewalls.