HKCERT, Hong Kong's computer emergency response team, published a bulletin on 9 November 2026 about a flaw in ModSecurity. ModSecurity is a web application firewall, a filter that inspects web requests before they reach an application. HKCERT says a remote attacker could use the flaw to get around its security restrictions. The flaw is tracked as CVE-2026-104269. HKCERT says affected versions are 3.0.0 up to, but not including, 3.0.17. It lists a 3.0.17 release on GitHub.
HKCERT says proof-of-concept exploit code is public. It explains the cause this way: ModSecurity's multipart parser, which reads file uploads, does not follow the RFC 2231 rule for the filename* parameter. Common Go, Python, Node.js and Java parsers do follow that rule. So an application can end up with a filename the firewall never inspected. The risk applies when the application uses that name to store files, check extensions or guess content type. The bulletin gives no word on attacks in the wild. It does not say how severe the flaw is rated.
For teams that run ModSecurity 3.x in front of upload features, the version number is the first check. The bulletin points to release 3.0.17 and a GitHub advisory for details. It also shows that a firewall and an application can read the same upload differently, and that gap is where this bypass sits.