Memory Corruption Vulnerability in ModSecurity Web Application Firewall

CVE-2026-73857

What is CVE-2026-73857?

ModSecurity, an open-source web application firewall for various server platforms, is affected by a vulnerability in the XML request body processing feature across versions 3.0.15 through 3.0.17. When the SecParseXmlIntoArgs setting is activated, an attacker can send a specially crafted unauthenticated HTTP request that results in an uninitialized pointer dereference during the SAX end-element callback. This can lead to memory corruption, which could crash the worker process and potentially disclose sensitive memory information or redirect execution flow. The issue has been addressed in version 3.0.17, and users are encouraged to upgrade immediately.

References