https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 01:51:23 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-73857 <p>ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsing_ctx_arg uninitialized in the SAX end-element callback. A single crafted unauthenticated HTTP request can make a worker dereference the pointer, resulting in a constant-value write to an attacker-controlled address. The resulting memory corruption can terminate the worker and may disclose memory or redirect execution. Earlier 3.0.x releases and ModSecurity 2.x do not use the affected path. This issue is fixed in version 3.0.17.</p> <p>ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsing_ctx_arg uninitialized in the SAX end-element callback. A single crafted unauthenticated HTTP request can make a worker dereference the pointer, resulting in a constant-value write to an attacker-controlled address. The resulting memory corruption can terminate the worker and may disclose memory or redirect execution. Earlier 3.0.x releases and ModSecurity 2.x do not use the affected path. This issue is fixed in version 3.0.17.</p> https://db.gcve.eu/vuln/fkie_cve-2026-73857 https://db.gcve.eu/vuln/ubuntu-cve-2026-73857 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: modsecurity, Ubuntu:22.04:LTS: modsecurity, Ubuntu:24.04:LTS: modsecurity, Ubuntu:26.10: modsecurity, Ubuntu:26.04:LTS: modsecurity</p> <p>[GHSA-jx3r-phvx-2jmj: XML request body processor dereferences an uninitialized parser context pointer]</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: modsecurity, Ubuntu:22.04:LTS: modsecurity, Ubuntu:24.04:LTS: modsecurity, Ubuntu:26.10: modsecurity, Ubuntu:26.04:LTS: modsecurity</p> <p>[GHSA-jx3r-phvx-2jmj: XML request body processor dereferences an uninitialized parser context pointer]</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-73857 https://db.gcve.eu/vuln/wid-sec-w-2026-3666 <p>Ein Angreifer kann mehrere Schwachstellen in OWASP ModSecurity ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen und um einen Denial of Service Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in OWASP ModSecurity ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen und um einen Denial of Service Angriff durchzuführen.</p> https://db.gcve.eu/vuln/wid-sec-w-2026-3666