CVE-2026-21876
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- coreruleset 4.21.0 - Firewall Bypass2026-05-13 · webapps · multiple
Impact
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Owasp | Owasp Modsecurity Core Rule Set | before 3.3.8 from 4.0.0 before 4.22.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/coreruleset/coreruleset/commit/80d80473abf71bd49bf6d3c1ab221e3c74e4eb83
- https://github.com/coreruleset/coreruleset/commit/9917985de09a6cf38b3261faf9105e909d67a7d6
- https://github.com/coreruleset/coreruleset/releases/tag/v3.3.8
- https://github.com/coreruleset/coreruleset/releases/tag/v4.22.0
- https://github.com/coreruleset/coreruleset/security/advisories/GHSA-36fv-25j3-r2c5
- https://github.com/daytriftnewgen/CVE-2026-21876