OWASP CRS has multipart bypass using multiple content-type parts
Résumé
OWASP CRS has multipart bypass using multiple content-type parts
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like MULTIPART_PART_HEADERS), the capture variables (TX:0, TX:1) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2026-21876 modsecurity-crs Corrigé dans: 3.3.4-1~deb11u2
- Ubuntu UBUNTU-CVE-2026-21876 modsecurity-crs
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- report github.com
- web github.com
- web github.com