CVE-2026-104259

Name of the Vulnerable Software and Affected Versions ModSecurity versions prior to 2.9.15 ModSecurity versions prior to 3.0.17

Description The t:removeComments transformation, implemented via the msre fn removeComments execute() function in apache2/re tfns.c and the inplace() function in src/actions/transformations/remove comments.cc, incorrectly copies the character immediately following a comment terminator without re-evaluating it. This behavior allows adjacent comments to leave a subsequent comment in the transformed value, enabling inline-comment obfuscation to bypass security rules that rely on comment stripping. Additionally, if a comment terminator is the final character of the content, the process reads one byte beyond the input buffer.

Recommendations Update to version 2.9.15 or later. Update to version 3.0.17 or later.