CVE-2026-21876

216.73.217.139

· Published 08/01/2026 14:15 · Modified 08/01/2026 18:08

Labels: CVE-2026-21876 2026-01-08 CVE-2026-21876 CWE-794 [email protected]

Essential information

Published: 08/01/2026 14:15
Modified: 08/01/2026 18:08
Author: —
Creator: —
CVSS: 9.3 CRITICAL (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

CVSS metrics

Description

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.

NVD status

Status: Awaiting Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
owasp / core rule set	`cpe:2.3:a:owasp:core_rule_set:<4.22.0:::::::*`
owasp / core rule set	`cpe:2.3:a:owasp:core_rule_set:<3.3.8:::::::*`