CVE-2026-73857

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsing_ctx_arg uninitialized in the SAX end-element callback. A single crafted unauthenticated HTTP request can make a worker dereference the pointer, resulting in a constant-value write to an attacker-controlled address. The resulting memory corruption can terminate the worker and may disclose memory or redirect execution. Earlier 3.0.x releases and ModSecurity 2.x do not use the affected path. This issue is fixed in version 3.0.17.

• CWE-787
• CWE-824

• https://github.com/owasp-modsecurity/ModSecurity/commit/e979a73e89d60cefdf42b41bb38bf1e456d7909f
• https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17
• https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-jx3r-phvx-2jmj

Published

Nov 9, 2026

Last Modified

Nov 10, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73848Emlog is an open source website building system. In versions…6.9
• CVE-2026-73849Emlog is an open source website building system. In 2.6.26 a…9.8
• CVE-2026-7385The Decent Comments WordPress plugin before 3.0.2 does not r…5.8
• CVE-2026-73850Emlog is an open source website building system. In 2.6.20 a…8.6
• CVE-2026-73851Kiota is an OpenAPI based HTTP Client code generator. Prior …6.1
• CVE-2026-73856ModSecurity is an open source, cross platform web applicatio…8.6
• CVE-2026-73858Solspace Freeform plugin for Craft CMS 5.x is a super flexib…5.3
• CVE-2026-7386A flaw has been found in fatbobman mail-mcp-bridge up to 1.3…7.3
• CVE-2026-73860Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-73863NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-…7
• CVE-2026-73865Vulnerability in the Helidon product of Oracle Fusion Middle…9.1
• CVE-2026-73866Vulnerability in the Helidon product of Oracle Fusion Middle…9.1