CVE-2026-21876

MEDIUM EPSS 95.9%
Published Jan 8, 20265mo ago · Modified Jun 17, 20261w ago
5.3 CVSS 3.1
Medium
Find Similar
Published Jan 8, 2026 5mo ago
Last Modified Jun 17, 2026 1w ago

Description

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.

CVSS Details

Base Score
5.3
Exploitability
3.9
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
95.9% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-794

Affected Products 2

VendorProductVersionRange
owaspowasp_modsecurity_core_rule_set* <3.3.8
owaspowasp_modsecurity_core_rule_set*≥4.0.0  –  <4.22.0

References 6

  • github.com https://github.com/coreruleset/coreruleset/commit/80d80473abf71bd49bf6d3c1ab221e3c74e4eb83
    Patch
  • github.com https://github.com/coreruleset/coreruleset/commit/9917985de09a6cf38b3261faf9105e909d67a7d6
    Patch
  • github.com https://github.com/coreruleset/coreruleset/releases/tag/v3.3.8
    ProductRelease Notes
  • github.com https://github.com/coreruleset/coreruleset/releases/tag/v4.22.0
    ProductRelease Notes
  • github.com https://github.com/coreruleset/coreruleset/security/advisories/GHSA-36fv-25j3-r2c5
    ExploitVendor Advisory
  • github.com https://github.com/daytriftnewgen/CVE-2026-21876

Remediation

  • github.com https://github.com/coreruleset/coreruleset/commit/80d80473abf71bd49bf6d3c1ab221e3c74e4eb83
    Patch
  • github.com https://github.com/coreruleset/coreruleset/commit/9917985de09a6cf38b3261faf9105e909d67a7d6
    Patch