A crafted unauthenticated HTTP request can trigger an uninitialized pointer dereference in ModSecurity’s XML request body processing when SecParseXmlIntoArgs is set to On or OnlyArgs, causing a worker to write a constant value to an attacker‑controlled address. This memory corruption can terminate the worker process, potentially expose sensitive memory contents, and may allow an attacker to redirect execution flow, leading to possible remote code execution or denial of service.

The vulnerability affects ModSecurity version 3.0.15 through 3.0.17 when using the XML request body processor. Earlier 3.0.x releases and all ModSecurity 2.x releases are not impacted. The flaw is present in deployments on Apache, IIS, and Nginx that load these affected ModSecurity versions.

The CVSS score of 7.5 indicates a high‑severity flaw. No EPSS score is available, but the vulnerability is actively exploitable via an unauthenticated HTTP request. The issue is not listed in the CISA KEV catalog. An attacker can easily craft a request that triggers the uninitialized pointer dereference, causing a worker crash, memory disclosure, or potential code execution.