Comment Stripping Vulnerability in ModSecurity Web Application Firewall
CVE-2026-104259

5.4MEDIUM

Key Information:

Vendor

Owasp-modsecurity

Status
Modsecurity
Vendor
CVE Published:
9 November 2026

What is CVE-2026-104259?

ModSecurity, an open source web application firewall, contains a vulnerability in the comment stripping functionality prior to versions 2.9.15 and 3.0.17. The issue occurs in the msre_fn_removeComments_execute function of Apache and the inplace() function in the comment removal process. This vulnerability allows adjacent comments to interfere, potentially resulting in comment obfuscation that could evade specific firewall rules. Furthermore, if a comment terminator is the last piece of content, this implementation reads beyond the input buffer. The vulnerability has been resolved in subsequent releases.

Affected Version(s)

ModSecurity < 2.9.15 < 2.9.15

ModSecurity >= 3.0.0, < 3.0.17 < 3.0.0, 3.0.17

References

https://github.com/owasp-modsecurity/ModSecurity/security...
x_refsource_CONFIRM
https://github.com/owasp-modsecurity/ModSecurity/commit/2...
x_refsource_MISC
https://github.com/owasp-modsecurity/ModSecurity/commit/4...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.