Always-Incorrect Control Flow Implementation in ModSecurity - CVE-2026-104259
Published: November 4, 2026
Vulnerability identifier: #VU159006
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-104259
CWE-ID: CWE-670
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass web application firewall rules that depend on comment stripping, potentially allowing malicious requests to reach the protected application.
The vulnerability exists due to incorrect control flow in ModSecurity's removeComments transformation when processing immediately adjacent comments. A remote attacker can submit input such as /*A*//*B*/ to leave the second comment unmodified and evade detection rules that rely on t:removeComments to normalize comment-obfuscated payloads.
Affected software
ModSecurity
How to mitigate CVE-2026-104259
Install security update from vendor's website.
ModSecurity - addressed in versions 2.9.15, 3.0.17