Skip to content
OpenAdvisories
High WID-SEC-2026-3666 7 CVEs

OWASP ModSecurity: Mehrere Schwachstellen

Published Sep 29, 2026 · Updated Nov 9, 2026 · Revision 5 · de

Vendor: amazon Vendor: OWASP Product: Linux 2 Product: ModSecurity Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in OWASP ModSecurity ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen und um einen Denial of Service Angriff durchzuführen.

Product

ModSecurity ist eine Open Source Web Application Firewall, die für verschiedene Webserver verfügbar ist.

Vulnerabilities 7

  • High 8.6
    CVE-2026-104269

    ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)

    ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.j…

    owasp-modsecurity ModSecurity modsecurity modsecurity Debian Ubuntu
  • High 8.6
    CVE-2026-73856

    ModSecurity: Response Body Inspection Bypass

    ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed…

    owasp-modsecurity ModSecurity modsecurity modsecurity Debian Ubuntu
  • High 7.5
    CVE-2026-73857

    ModSecurity v3 XML Request Body Processor Uninitialized Pointer Dereference Vulnerability

    ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsing_ctx_arg uninitializ…

    owasp-modsecurity ModSecurity modsecurity modsecurity Debian Ubuntu
  • Medium 6.3
    CVE-2026-61812

    ModSecurity: HTML decoder missing entities, leading to evasion

    ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, t:htmlEntityDecode recognizes only a small subset of named HTML entities, so rules that depend on the transformation can…

    owasp-modsecurity ModSecurity modsecurity modsecurity Debian Ubuntu Azure Linux
  • Medium 5.8
    CVE-2026-103932

    ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match

    ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-mat…

    owasp-modsecurity ModSecurity modsecurity modsecurity Debian Ubuntu
  • Medium 5.4
    CVE-2026-104259

    ModSecurity: removeComments Transformation Fails to Strip Adjacent Comments, Enabling WAF Rule Bypass

    ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, msre_fn_removeComments_execute in apache2/re_tfns.c and inplace() in src/actions/transformations/remove_comments.cc impl…

    owasp-modsecurity ModSecurity modsecurity modsecurity Debian Ubuntu Azure Linux
  • Low 3.7
    CVE-2026-61813

    ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download

    ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOST to 1 instead of the …

    owasp-modsecurity ModSecurity modsecurity modsecurity Debian Ubuntu Azure Linux

Revision history

  1. #5

    Referenz(en) aufgenommen: EUVD-2026-120507, EUVD-2026-120508, EUVD-2026-120509

  2. #4

    CVE aufgenommen + PoC

  3. #3

    Referenz(en) aufgenommen: EUVD-2026-117554, EUVD-2026-117553, CVE-2026-104269, EUVD-2026-117555, CVE-2026-103932, EUVD-2026-117551

  4. #2

    Neue Updates von Amazon aufgenommen

  5. #1

    Initiale Fassung

References