Skip to content
OpenAdvisories
High ALAS2023-2026-3247 1 CVE

Important: mod_security security update (Amazon Linux 2023)

Published Oct 26, 2026 · Updated Oct 26, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-104269: GHSA-5pww-8rfg-9crf: RFC 2231 filename* parameter bypasses multipart filename rules

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2023 mod_security 0:2.9.15-1.amzn2023.0.1
Amazon Linux · 2023 mod_security-debuginfo 0:2.9.15-1.amzn2023.0.1
Amazon Linux · 2023 mod_security-debugsource 0:2.9.15-1.amzn2023.0.1
Amazon Linux · 2023 mod_security-mlogc 0:2.9.15-1.amzn2023.0.1
Amazon Linux · 2023 mod_security-mlogc-debuginfo 0:2.9.15-1.amzn2023.0.1

Vulnerabilities 1

  • High 8.6
    CVE-2026-104269

    ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)

    ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.j…

    owasp-modsecurity ModSecurity modsecurity modsecurity Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-104269.html