Modsecurity: [GHSA-jx3r-phvx-2jmj: XML request body processor dereferences an uninitialized parser context pointer] (CVE-2026-73857)

CVE-2026-73857 describes a vulnerability in ModSecurity where the XML request body processor dereferences an uninitialized parser context pointer. This flaw could potentially lead to undefined behavior or crashes when processing XML request bodies. The vulnerability affects specific versions of ModSecurity, including 3.0.3-1, 3.0.4-1, 3.0.4-1build1, 3.0.4-2, 3.0.6-1, 3.0.10-1, 3.0.11-1, 3.0.12-1, 3.0.12-1.1build1, 3.0.12-1.1build2, 3.0.14-1build2, 3.0.15-1, 3.0.16-1, and 3.0.14-1build1. No patch or remediation information is provided, and no exploits are known in the wild.

The vulnerability may cause crashes or unstable behavior in ModSecurity when processing XML request bodies due to dereferencing an uninitialized pointer. The medium severity suggests moderate impact, but no further details on exploitation or data compromise are available. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor official ModSecurity advisories for updates. No specific mitigation steps are provided in the available data.