CVE-2026-104259: ModSecurity: removeComments Transformation Fails to Strip Adjacent Comments, Enabling WAF Rule Bypass

Q: Which deployments are affected?

Deployments using ModSecurity versions earlier than 2.9.15 or 3.0.17 are affected if their rules rely on the t:removeComments transformation. The issue applies to ModSecurity deployments for Apache, IIS, and Nginx.

Q: What does an attacker need to exploit this issue?

An attacker needs to send input containing adjacent inline comments that is evaluated by a WAF rule relying on comment stripping. No privileges or user interaction are required, but successful exploitation depends on the affected rule configuration and the use of this transformation.

Q: Are default configurations necessarily vulnerable?

The provided information does not establish that a default rule configuration uses t:removeComments. Exposure depends on whether deployed rules rely on this transformation when inspecting attacker-controlled input.

Q: What should be done if patching cannot happen immediately?

Identify rules that use t:removeComments and assess whether inline-comment obfuscation could evade their matching logic. Until an update is applied, avoid relying solely on this transformation for comment normalization in security-critical rules.

Q: How can I determine whether my deployment is affected?

Check the installed ModSecurity version and review active rules for use of t:removeComments. Versions earlier than 2.9.15 or 3.0.17 with such rules should be treated as affected.

Published Nov 9, 2026

Updated

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, msrefnremoveCommentsexecute in apache2/retfns.c and inplace() in src/actions/transformations/removecomments.cc implement t:removeComments by copying the character immediately after a comment terminator without re-evaluating it. Adjacent comments can therefore leave a later comment in the transformed value, allowing inline-comment obfuscation to bypass rules that depend on comment stripping. When a comment terminator is the final content, the same copy reads one byte beyond the input buffer. This issue is fixed in versions 2.9.15 and 3.0.17.

Affected Software

1 affected component

OWASP Modsecurity<2.9.15, <3.0.17

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ModSecurity 2.9.x or 3.0.x to a version that resolves this vulnerability.
Fixed in 2.9.15Patch 3.0.17

Event History

Nov 9, 2026

CVE Published

via MITRE·09:37 PM

Data Sourced

via MITRE·09:37 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Deployments using ModSecurity versions earlier than 2.9.15 or 3.0.17 are affected if their rules rely on the t:removeComments transformation. The issue applies to ModSecurity deployments for Apache, IIS, and Nginx.

What does an attacker need to exploit this issue?

An attacker needs to send input containing adjacent inline comments that is evaluated by a WAF rule relying on comment stripping. No privileges or user interaction are required, but successful exploitation depends on the affected rule configuration and the use of this transformation.

Are default configurations necessarily vulnerable?

The provided information does not establish that a default rule configuration uses t:removeComments. Exposure depends on whether deployed rules rely on this transformation when inspecting attacker-controlled input.

What should be done if patching cannot happen immediately?

Identify rules that use t:removeComments and assess whether inline-comment obfuscation could evade their matching logic. Until an update is applied, avoid relying solely on this transformation for comment normalization in security-critical rules.

How can I determine whether my deployment is affected?

Check the installed ModSecurity version and review active rules for use of t:removeComments. Versions earlier than 2.9.15 or 3.0.17 with such rules should be treated as affected.

CVE-2026-104259: ModSecurity: removeComments Transformation Fails to Strip Adjacent Comments, Enabling WAF Rule Bypass

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Are default configurations necessarily vulnerable?

What should be done if patching cannot happen immediately?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Are default configurations necessarily vulnerable?

What should be done if patching cannot happen immediately?

How can I determine whether my deployment is affected?