SB2026110411 - Multiple vulnerabilities in ModSecurity

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110411

SB2026110411 - Multiple vulnerabilities in ModSecurity

Published: November 4, 2026

Security Bulletin ID SB2026110411
CSH Severity
High
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

High 17% Medium 83%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Protection mechanism failure (CVE-ID: N/A)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass web application firewall rules that inspect base64-decoded input.

The vulnerability exists due to improper handling of malformed base64 padding in ModSecurity's t:base64DecodeExt transformation when decoding attacker-controlled input for rule matching. A remote attacker can insert a malformed padding group such as A== into a base64-encoded value to cause the entire decoded output to be silently discarded, bypassing rules that inspect the transformed content.


2) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-104259)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass web application firewall rules that depend on comment stripping, potentially allowing malicious requests to reach the protected application.

The vulnerability exists due to incorrect control flow in ModSecurity's removeComments transformation when processing immediately adjacent comments. A remote attacker can submit input such as /*A*//*B*/ to leave the second comment unmodified and evade detection rules that rely on t:removeComments to normalize comment-obfuscated payloads.


3) Incorrect Check of Function Return Value (CVE-ID: CVE-2026-103932)

CWE-ID: CWE-253 - Incorrect Check of Function Return Value

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass compensating security rules in affected ModSecurity configurations, allowing requests that should be rejected to pass through the web application firewall.

The vulnerability exists due to incorrect checking of function return values in the PCRE2 implementation of ModSecurity's @rxGlobal operator when processing input that exhausts the configured regular-expression match limit. A remote attacker can submit specially crafted input to cause match-limit errors to be treated as successful evaluation with no match, leaving the PCRE-limit indicators unset and bypassing rules that depend on those indicators to block incomplete inspection.


4) Access of Uninitialized Pointer (CVE-ID: CVE-2026-73857)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to access of an uninitialized pointer in the ModSecurity v3 XML request body processor when processing XML request bodies in the XML-into-ARGS SAX end-element callback. A remote attacker can send a single crafted HTTP request to trigger dereferencing of XMLNodes::parsing_ctx_arg, causing a constant value to be written to an attacker-controlled address and crashing the web server worker process.

The vulnerable code path is reachable only when SecParseXmlIntoArgs is set to On or OnlyArgs; the directive is Off by default.


5) Improper Handling of Case Sensitivity (CVE-ID: CVE-2026-73856)

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass response body inspection and obtain sensitive information that would otherwise be blocked.

The vulnerability exists due to improper handling of case sensitivity in ModSecurity's SecResponseBodyMimeType matching logic in src/transaction.cc when checking backend response Content-Type values. A remote attacker can trigger a backend response with Content-Type: Text/Html instead of text/html to cause RESPONSE_BODY rules to be skipped and retrieve sensitive response content.


6) Encoding Error (CVE-ID: CVE-2026-61812)

CWE-ID: CWE-172 - Encoding Error

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass security rules that rely on HTML entity decoding to normalize input.

The vulnerability exists due to incomplete decoding of named HTML entities in the t:htmlEntityDecode transformation when processing request input. A remote attacker can encode payload characters using unrecognized entities, such as q=javascript:execute_my_code();, to evade rules that would block the decoded payload.


Remediation

Install update from vendor's website.

References