OWASP CRS has multipart bypass using multiple content-type parts
概要
OWASP CRS has multipart bypass using multiple content-type parts
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like MULTIPART_PART_HEADERS), the capture variables (TX:0, TX:1) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2026-21876 modsecurity-crs 修正版: 3.3.4-1~deb11u2
- Ubuntu UBUNTU-CVE-2026-21876 modsecurity-crs
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- report github.com
- web github.com
- web github.com