Skip to content
OpenAdvisories
High ALAS2-2026-4010 1 CVE

Important: mod_security security update (Amazon Linux 2)

Published Oct 26, 2026 · Updated Oct 26, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-104269: GHSA-5pww-8rfg-9crf: RFC 2231 filename* parameter bypasses multipart filename rules

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 mod_security 0:2.9.15-1.amzn2.0.1
Amazon Linux · 2 mod_security-debuginfo 0:2.9.15-1.amzn2.0.1
Amazon Linux · 2 mod_security-mlogc 0:2.9.15-1.amzn2.0.1

Vulnerabilities 1

  • High 8.6
    CVE-2026-104269

    ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)

    ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.j…

    owasp-modsecurity ModSecurity modsecurity modsecurity Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-104269.html