CVE-2026-73857

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsingctxarg uninitialized in the SAX end-element callback. A sing...

DEBIAN-CVE-2026-73857

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsingctxarg uninitialized in the SAX end-element callback. A sing...

EUVD-2026-120508

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsingctxarg uninitialized in the SAX end-element callback. A sing...

CVE-2026-73857 ModSecurity v3 XML Request Body Processor Uninitialized Pointer Dereference Vulnerability

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsingctxarg uninitialized in the SAX end-element callback. A sing...

CVE-2026-73857

The ModSecurity web application firewall engine (versions 3.0.15 through 3.0.16 ) is vulnerable to a memory corruption issue during XML request body processing. When SecParseXmlIntoArgs is set to On or OnlyArgs , the XMLNodes::parsing_ctx_arg pointer can remain uninitialized in the SAX end-elemen...

CVE-2026-73857: owasp-modsecurity ModSecurity: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsingctxarg uninitialized in the SAX end-element callback. A sing...

ModSecurity WAF Bypass

The vulnerability of the network firewall for protecting web applications related to ModSecurity lies in insufficient validation of input data during the processing of the SecParseXmlIntoArgs parameter. Exploiting this vulnerability allows a malicious actor to bypass the rules of the WAF...

Unity Linux 20.1070e Security Update: mod_security (UTSA-2025-993341)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993341 advisory. ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can...

CVE-2025-52891

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least...

CVE-2025-52891: Improper Input Validation

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least...