{"id":"EM-20261105-I86N","url":"https://cyber.eventmonitor.net/incident/EM-20261105-I86N/modsecurity-vulnerability-cve-2026-104269/","type":"cve","title":"ModSecurity Vulnerability (CVE-2026-104269)","subtitle":"CVE-2026-104269","subject":"CVE-2026-104269","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-05T16:17:29.377Z","firstSignal":"2026-11-05T15:51:18.000Z","lastSignal":"2026-11-05T16:17:29.377Z","updated":"2026-11-06T12:16:45.734Z","revision":1,"life":[{"status":"Born","at":"2026-11-05T16:17:29.377Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-05T16:17:29.377Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-05T15:51:18.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-05T16:17:29.377Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261105-I86N created."}],"stages":[{"name":"Disclosed","at":"2026-11-05T16:17:29.377Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-05T16:17:29.377Z","detail":"CVSS 8.6"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-05T15:51:18.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-05T15:51:18.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":3,"title":"Red Hat: CVE-2026-104269 (important)","text":"modsecurity: mod_security: ModSecurity: Security inspection bypass via multipart filename parameter discrepancy","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-104269.json"},{"at":"2026-11-05T16:17:29.377Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-104269 (CVSS 8.6)","text":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. A Content-Disposition header can provide a benign filename parameter for ModSecurity and a different encoded filename* value that the backend prefers, causing MULTIPART_FILENAME rules and the application to make security decisions on different names. Applications that use the backend-selected name for…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104269"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-05T16:17:29.377","score":8.6,"severity":"HIGH","desc":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. A…","product":"","seen":1793905338609},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}