Back Hkcert

ModSecurity Security Restriction Bypass Vulnerability

Hkcert • November 9, 2026

A vulnerability was identified in ModSecurity. A remote attacker could exploit this vulnerability to trigger security restriction bypass on the targeted system.

Proof of Concept exploit code is publicly available for CVE-2026-104269. ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. Applications that use the backend-selected name for storage, extension checks, or content-type inference can therefore receive a filename that bypassed WAF inspection.

System / Technologies affected

ModSecurity versions 3.0.0 and later, but earlier than 3.0.17 (≥ 3.0.0, < 3.0.17)

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

Vulnerability Identifier

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

High-Severity ModSecurity Vulnerabilities Allow WAF Bypass Two high-severity vulnerabilities in ModSecurity, tracked as CVE-2026-104269 and CVE-2026-73857, were disclosed on November 5, 2026. CVE-2026-104269 allows attackers to bypass file upload restrictions due to a parser mismatch in the multipart parser, affecting versions 3.0.0 and later. The flaw can lead to remote code execution if an attacker sends a crafted HTTP request. CVE-2026-73857 involves an uninitialized pointer dereference that could lead to denial of service or memory disclosure, affecting versions 3.0.15 and 3.0.16. Administrators are urged to upgrade to version 3.0.17 and implement server-side validation for file uploads. Proof-of-concept exploit code for CVE-2026-104269 is publicly available. The vulnerabilities highlight the parser-differential problem seen in web application firewalls. 2 sources 71

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

CVE-2026-104269