CVE-2026-104269
- Source
- https://cve.org/CVERecord?id=CVE-2026-104269
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104269.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-104269
- Aliases
-
- GHSA-5pww-8rfg-9crf
- Downstream
- Published
- 2026-11-05T15:51:18Z
- Modified
- 2026-11-06T01:21:37Z
- Severity
-
- 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N CVSS Calculator
- Summary
- ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)
- Details
-
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. A Content-Disposition header can provide a benign filename parameter for ModSecurity and a different encoded filename* value that the backend prefers, causing MULTIPART_FILENAME rules and the application to make security decisions on different names. Applications that use the backend-selected name for storage, extension checks, or content-type inference can therefore receive a filename that bypassed WAF inspection. PHP's native multipart parser is not affected by this discrepancy. This issue is fixed in version 3.0.17.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-436" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104269.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104269.json
- https://github.com/owasp-modsecurity/ModSecurity/commit/463db0c840fa27bfba095b0406a63004a12884b0
- https://github.com/owasp-modsecurity/ModSecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d
- https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15
- https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17
- https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf
- https://nvd.nist.gov/vuln/detail/CVE-2026-104269
Affected packages
Git / github.com/owasp-modsecurity/modsecurity
Affected ranges
- Type
- GIT
- Repo
- https://github.com/owasp-modsecurity/modsecurity
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "3.0.0" }, { "fixed": "3.0.17" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "463db0c840fa27bfba095b0406a63004a12884b0" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "c6bd53d2dd96766b3afdc35d9929ebb20925d13d" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v2.9.15", "range": [ { "fixed": "151074aca78a416764b12ba1221e61a17a6c714d" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v3.0.17", "range": [ { "fixed": "1925753989ccce977cdaae417b55c9726c7cf02c" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
v3.*
v3.0.0
v3.0.1
v3.0.10
v3.0.11
v3.0.12
v3.0.13
v3.0.14
v3.0.15
v3.0.16
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.0.8
v3.0.9
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104269.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "56308857746510941646154099105790950546",
"length": 5557
},
"id": "CVE-2026-104269-044e78e8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d",
"target": {
"file": "apache2/msc_multipart.c",
"function": "multipart_process_part_header"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"181288368375911585089525863190000845448",
"29160699570944174066810108174660822101",
"77758569666466400662228290522844326075",
"176967307963386954939226552236395303801",
"198480082574236009321666379222595490086",
"218243900386729468330740265153946839589",
"185381678836484806151238644815464767545",
"74624317027142978860667459249478534609",
"93599785298560177639963665918451525077",
"211761549098374640206527345855203912415",
"194213410819120406302240306483913361493",
"22080530929285100258319923152840594182",
"217462566316334738538163338046520400173",
"188407880009680172299487171366469391578",
"104370126165594959525932517703723648960",
"328205030944725705708472632001612803245",
"175695967531232858131615642269221565553",
"257823321820471589835204543873981921754",
"214360312257237616204289856753923382696",
"299909592527311222913146955708013776198",
"137216015559980228341679727694716776841",
"163176972376994791611983939217601573220",
"281357068446678541922082999082985384304",
"52696875585814156116792197227488237720",
"327886693176660415930344020773679929454",
"278532532885143030796822790163784800581",
"37246573313487635640109788636976848221",
"123556399904879978577923460981245157015",
"182896698060355980036142442588157524610",
"279657015043618529691178714750720801316",
"140067781787589373106742419175935196723",
"307260498161311081795736751024218755045",
"271945405617232894787125968336100768160",
"98844109227792703746452876753263374831",
"86826772199694754306168980251040105700",
"190412794591833611749433370954594006501",
"205983125572027382441555436147902568005",
"183182025781328379049814748077266299323",
"27905481209400668523360138486788328351",
"267697332410898371221141680496807743556",
"271722072814545602786934260196556491916"
],
"threshold": 0.9
},
"id": "CVE-2026-104269-04d98f96",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d",
"target": {
"file": "apache2/msc_multipart.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "112817149169959535605173830262791313376",
"length": 3177
},
"id": "CVE-2026-104269-18a48aab",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d",
"target": {
"file": "apache2/msc_multipart.c",
"function": "multipart_parse_content_disposition"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "321130518049355283973875220642798368836",
"length": 4519
},
"id": "CVE-2026-104269-1f88eb82",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/owasp-modsecurity/modsecurity/commit/463db0c840fa27bfba095b0406a63004a12884b0",
"target": {
"file": "src/request_body_processor/multipart.cc",
"function": "Multipart::parse_content_disposition"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "53828602816614011323429035922260899965",
"length": 210
},
"id": "CVE-2026-104269-2389618b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d",
"target": {
"file": "apache2/re_variables.c",
"function": "var_multipart_filename_generate"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "330559386977266741059775083093642790329",
"length": 578
},
"id": "CVE-2026-104269-377fa62c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/owasp-modsecurity/modsecurity/commit/463db0c840fa27bfba095b0406a63004a12884b0",
"target": {
"file": "src/request_body_processor/multipart.cc",
"function": "Multipart::boundary_characters_valid"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "275868046060475032066664230439594374903",
"length": 845
},
"id": "CVE-2026-104269-3de6bb8e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d",
"target": {
"file": "apache2/re_variables.c",
"function": "var_multipart_strict_error_generate"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"148487130232350485130524793699670545570",
"5202569998189601112350134975259572217",
"226373612133383281162430209701120683627",
"179940194439108508557241461884975667860",
"272574756236909064569300175925734923265",
"315158504813905608415949123435425142659",
"112734507780241885773100325847658277410",
"232621421232674570248537521626762753551",
"29705950276346438433728152315750987341",
"312342057635865404216581601677392882561",
"24456353439263408652103122237635396690",
"165687390343396469223961473464092542750",
"232940907512882136191072996922482924148",
"253795135954498140472273625749566664205",
"27017642478877065164000264519013889518",
"203749054793978391870251099679299080503",
"177257144842503668945075126072742754439",
"177248029478119800855818520734148304123",
"239224767538649636823499295396773004260",
"81567929543715481929347371172607647387",
"209894854975938528405192162179369800734",
"3803867300325315412586415924345426224",
"146057784766785098790482724214351440806",
"157261903685185776441950043703477723186",
"113592310620153460747999772114130562805",
"237486086129796718620215652102711803029",
"36900995387447423098677475710791776933",
"208055885334890885400885931386165439869",
"298509135544834431104924131003534222332",
"127457589045253652555035153884310073795",
"38747934203908436891383458482765871053",
"174777979221688503191179634290322823078"
],
"threshold": 0.9
},
"id": "CVE-2026-104269-7ff95e62",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d",
"target": {
"file": "apache2/re_variables.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "198344636349099981519187244353707977032",
"length": 17415
},
"id": "CVE-2026-104269-9112a686",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d",
"target": {
"file": "apache2/re_variables.c",
"function": "msre_engine_register_default_variables"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"65783423242000956284861315811786461343",
"304822891907056078573919138359639709559",
"303176374441222704770808956685701348014",
"169337650472129415157076120628266478324",
"313191381501382023265501242914944725041"
],
"threshold": 0.9
},
"id": "CVE-2026-104269-cc26767a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d",
"target": {
"file": "apache2/modsecurity.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "251453810230046196056899878220861982291",
"length": 5614
},
"id": "CVE-2026-104269-d25f08b6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/owasp-modsecurity/modsecurity/commit/463db0c840fa27bfba095b0406a63004a12884b0",
"target": {
"file": "src/request_body_processor/multipart.cc",
"function": "Multipart::process_part_header"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"129925274074619421093322675494484688832",
"287093577140933602951261145560423645275",
"163403612458206506577598925761668532505",
"275750512226867890145221377224612239741",
"194221632005523334803006594946995778283",
"337282787063510724515402521474698001556",
"90619705151482102609435467430759057546",
"196529140353937502691983945685059920826"
],
"threshold": 0.9
},
"id": "CVE-2026-104269-e9bdd3c3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d",
"target": {
"file": "apache2/msc_multipart.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "311278085433192019786801298975918912818",
"length": 206
},
"id": "CVE-2026-104269-ea2ffd35",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d",
"target": {
"file": "apache2/re_variables.c",
"function": "var_multipart_name_generate"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"282199308163617245345953214317916028373",
"114337507814361457704957997138701362743",
"177119550387298995213153168955437729526",
"262250992318586014509412266689509911866",
"14625965571838802688494377191440834258",
"270344424870980732441106078928546105672",
"99356043633769070667018931306853491720",
"18269258274329717404498748394681419531",
"151032374069169387861667395288011468039",
"97742394079740469167025506600712227389",
"92878207242256464722260385610765000799",
"255872838410638484345752770967014979685",
"331601984186982275337260615486374155193",
"147312358014707133425082702063159829148",
"119985852973875077734720055269997582530",
"118666625918118172549954318711024843822",
"118201741891545628165334410729145553927",
"63641138075508684472797258749284260663",
"119571845048005851148115592762739303735",
"335320625254059685147248918633023941468",
"67252347631385029771663454684030971890",
"22597332563249438324069499115810986229",
"98771624469984334201111739704059303159",
"129493119702843588155731665574725120006",
"154806498632721136594145912581391384233",
"100687837683758894555801557503767341333",
"21458184872591033779439311756089590629",
"242477516283397977699270493130500824700",
"102378485387745884516402226283711372967",
"20602680469339064109612635492020931322",
"175264074117048577155377242076089318037",
"244161564492483091800812366032581502892",
"210131672758015006971378693991358457300",
"272991156256126540827230541589752411643",
"182918849034710893183583416426789242949",
"153961047400351456866629537165001728578",
"211327993413480168164332901751623231288",
"182989997806230004310992912879015361528",
"202864038481239671956073634153086806112",
"179945581167197590859709995129078898278",
"185183075418123488982534666066372639860",
"195229790403785008721065718788522694135",
"198559935455437379071600665465723281089",
"72139769628699395501643713640856574035",
"73637324663361994535954166978546469086",
"248518281449015023787260479715625002285",
"41678485999919058686737214829975007670",
"135802480007754219478680967201202924527",
"317372081254582779228843204485283394782",
"3171535333731015176022395581656153965",
"173791853076422243197722436100786488110",
"67004873231819972512867094643416345266",
"90440105969891369336214540292893902278",
"278545878761259790179257054376528051226",
"188293471661781198633876512092158939766",
"263466508011412818691310471060521532124",
"119395943564435613247536376630390468565",
"159870559646454555922200026810776604445",
"308145563612719927798611139168816516398"
],
"threshold": 0.9
},
"id": "CVE-2026-104269-ec848316",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/owasp-modsecurity/modsecurity/commit/463db0c840fa27bfba095b0406a63004a12884b0",
"target": {
"file": "src/request_body_processor/multipart.cc"
}
}
]
vanir_signatures_modified
"2026-11-06T01:21:37Z"