ModSecurity v3 XML Request Body Processor Uninitialized Pointer Dereference Vulnerability
Only affects ModSecurity v3.0.15 and v3.0.16 with SecParseXmlIntoArgs set to On or OnlyArgs. Fixed in 3.0.17.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 3.0.17
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. SecParseXmlIntoArgs is set to On or OnlyArgs Affected versions are v3.0.15, v3.0.16 and current v3/master
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 20/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
ModSecurity v3, an open source web application firewall engine used with Apache, IIS, and Nginx, has a flaw in its XML request body processing that can be triggered remotely, without logging in, by a single crafted HTTP request. The resulting memory corruption can crash the worker process, and it may also leak memory or redirect execution.
Read the original description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsing_ctx_arg uninitialized in the SAX end-element callback. A single crafted unauthenticated HTTP request can make a worker dereference the pointer, resulting in a constant-value write to an attacker-controlled address. The resulting memory corruption can terminate the worker and may disclose memory or redirect execution. Earlier 3.0.x releases and ModSecurity 2.x do not use the affected path. This issue is fixed in version 3.0.17.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure12/25Specific setups only, reachable over the network without a login
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.5/10CVSS 7.5
- No patch0/5No signal
What would change the score
- Would score about 70 if added to CISA KEV
- Would score about 65 if CISA's SSVC rates exploitation active
What to do
Check whether your setup matches what the bug needs.
SecParseXmlIntoArgs is set to On or OnlyArgs Affected versions are v3.0.15, v3.0.16 and current v3/masterUpgrade to a fixed version: 3.0.17.
Workaround: Set SecParseXmlIntoArgs to Off
Timeline
- CVE published
- First seen by cve.now
Affected versions
- owasp-modsecurity ModSecurity
From 3.0.15 · fixed in 3.0.17
Evidence 3
- Advisory
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-73857
Is CVE-2026-73857 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The XML request body processor uses an uninitialized pointer. Writing a constant value to an attacker-controlled address can cause denial of service, memory disclosure, or redirection of execution flow, which may lead to remote code execution.Source: github.com, github.com
Which versions are affected by CVE-2026-73857?
ModSecurity: from 3.0.15 before 3.0.17.Source: cve.now feed data
Am I affected, and how do I check?
Affected versions are v3.0.15, v3.0.16, and the current v3/master branch. The defect is reachable only when the SecParseXmlIntoArgs directive is set to On or OnlyArgs, so check that directive in your ModSecurity configuration and check your installed version.Source: github.com, github.com
How do I fix CVE-2026-73857?
Upgrade to ModSecurity 3.0.17, which contains the fix. If you cannot upgrade yet, set SecParseXmlIntoArgs to Off.Source: github.com, github.com