9.3
CVE-2026-21876
- EPSS 13.12%
- Veröffentlicht 08.01.2026 13:55:37
- Zuletzt bearbeitet 09.04.2026 16:16:26
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginOWASP CRS has multipart bypass using multiple content-type parts
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Owasp ≫ Owasp Modsecurity Core Rule Set Version < 3.3.8
Owasp ≫ Owasp Modsecurity Core Rule Set Version >= 4.0.0 < 4.22.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 13.12% | 0.959 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
|
| security-advisories@github.com | 9.3 | 3.9 | 4.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
|
CWE-794 Incomplete Filtering of Multiple Instances of Special Elements
The product receives data from an upstream component, but does not filter all instances of a special element before sending it to a downstream component.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
https://github.com/coreruleset/coreruleset/security/advisories/GHSA-36fv-25j3-r2c5
https://github.com/coreruleset/coreruleset/commit/80d80473abf71bd49bf6d3c1ab221e3c74e4eb83
https://github.com/coreruleset/coreruleset/commit/9917985de09a6cf38b3261faf9105e909d67a7d6
https://github.com/coreruleset/coreruleset/releases/tag/v3.3.8
https://github.com/coreruleset/coreruleset/releases/tag/v4.22.0
https://github.com/daytriftnewgen/CVE-2026-21876