CVE-2026-73857

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsingctxarg uninitialized in the SAX end-element callback. A sing...

DEBIAN-CVE-2026-73857

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsingctxarg uninitialized in the SAX end-element callback. A sing...

EUVD-2026-120508

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsingctxarg uninitialized in the SAX end-element callback. A sing...

CVE-2026-73857

The ModSecurity web application firewall engine (versions 3.0.15 through 3.0.16 ) is vulnerable to a memory corruption issue during XML request body processing. When SecParseXmlIntoArgs is set to On or OnlyArgs , the XMLNodes::parsing_ctx_arg pointer can remain uninitialized in the SAX end-elemen...

CVE-2026-73857: owasp-modsecurity ModSecurity: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsingctxarg uninitialized in the SAX end-element callback. A sing...