ModSecurity’s t:removeComments transformation incorrectly copies a character immediately after a comment terminator without re-evaluating it. When adjacent comments exist, a subsequent comment can remain in the transformed request, allowing an attacker to embed inline comments that bypass rules which rely on comment removal. This flaw is listed as CWE‑670 and can enable a malicious client to circumvent web‑application firewall protections.

The issue affects the OWASP ModSecurity web application firewall used with Apache, IIS, and Nginx. Any installation of ModSecurity before version 2.9.15 in the 2.x branch or before version 3.0.17 in the 3.x branch is vulnerable. All versions prior to these releases that contain the legacy msre_fn_removeComments_execute and inplace() functions are impacted.

The vulnerability carries a CVSS score of 5.4, indicating moderate severity, and is not listed in the CISA KEV catalog. EPSS data is not available, but the likely attack vector is remote HTTP traffic, where an adversary sends requests containing adjacent comments to exploit the transformation bug. Because the flaw only requires sending crafted input and does not need privileged access to the system, the exploitation complexity is low, but the impact includes bypassing any rule that depends on comment stripping, potentially leading to the execution of disallowed payloads.