CVE-2026-21876
OWASP CRS has multipart bypass using multiple content-type parts
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like MULTIPART_PART_HEADERS), the capture variables (TX:0, TX:1) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
OWASP CRS has multipart bypass using multiple content-type parts
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like MULTIPART_PART_HEADERS), the capture variables (TX:0, TX:1) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
- Record
CVE-2026-21876- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - Weakness
- CWE-794
- Updated
- 2026-11-02
EUVDEUVD-2026-1669
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like MULTIPART_PART_HEADERS), the capture variables (TX:0, TX:1) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
- Record
EUVD-2026-1669- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
NVD
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like MULTIPART_PART_HEADERS), the capture variables (TX:0, TX:1) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
- Record
CVE-2026-21876- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-794
- Updated
- 2026-11-02
OSV
OWASP CRS has multipart bypass using multiple content-type parts
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like MULTIPART_PART_HEADERS), the capture variables (TX:0, TX:1) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
- Record
CVE-2026-21876- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - Weakness
- CWE-794
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-21876
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like MULTIPART_PART_HEADERS), the capture variables (TX:0, TX:1) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
- Record
DEBIAN-CVE-2026-21876- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1103
mod_security_crs security update
The base rules are provided for mod_security by this package.
Security Fix(es):
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like MULTIPART_PART_HEADERS), the capture variables (TX:0, TX:1) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.(CVE-2026-21876)
- Record
OESA-2026-1103- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
Show 7 moreShow less
OSVOESA-2026-1104
mod_security_crs security update
The base rules are provided for mod_security by this package.
Security Fix(es):
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like MULTIPART_PART_HEADERS), the capture variables (TX:0, TX:1) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.(CVE-2026-21876)
- Record
OESA-2026-1104- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1105
mod_security_crs security update
The base rules are provided for mod_security by this package.
Security Fix(es):
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like MULTIPART_PART_HEADERS), the capture variables (TX:0, TX:1) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.(CVE-2026-21876)
- Record
OESA-2026-1105- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1106
mod_security_crs security update
The base rules are provided for mod_security by this package.
Security Fix(es):
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like MULTIPART_PART_HEADERS), the capture variables (TX:0, TX:1) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.(CVE-2026-21876)
- Record
OESA-2026-1106- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1107
mod_security_crs security update
The base rules are provided for mod_security by this package.
Security Fix(es):
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like MULTIPART_PART_HEADERS), the capture variables (TX:0, TX:1) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.(CVE-2026-21876)
- Record
OESA-2026-1107- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1108
mod_security_crs security update
The base rules are provided for mod_security by this package.
Security Fix(es):
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like MULTIPART_PART_HEADERS), the capture variables (TX:0, TX:1) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.(CVE-2026-21876)
- Record
OESA-2026-1108- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1573
mod_security_crs security update
The base rules are provided for mod_security by this package.
Security Fix(es):
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like MULTIPART_PART_HEADERS), the capture variables (TX:0, TX:1) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.(CVE-2026-21876)
- Record
OESA-2026-1573- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-21876
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like MULTIPART_PART_HEADERS), the capture variables (TX:0, TX:1) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
- Record
UBUNTU-CVE-2026-21876- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
modsecurity-crsDebian:12 |
before 3.3.4-1+deb12u1, plus listed versions 3.3.4-1 |
3.3.4-1+deb12u1 |
modsecurity-crsDebian:13 |
before 3.3.7-1+deb13u1, plus listed versions 3.3.7-1 |
3.3.7-1+deb13u1 |
modsecurity-crsDebian:14 |
before 3.3.8-1, plus listed versions 3.3.7-1 |
3.3.8-1 |
modsecurity-crsDebian:11 |
before 3.3.4-1~deb11u2, plus listed versions 3.3.0-13.3.0-1+deb11u13.3.2-13.3.4-1~deb11u1 |
3.3.4-1~deb11u2 |
mod_security_crsopenEuler:24.03-LTS-SP2 |
before 3.3.5-3.oe2403sp2 | 3.3.5-3.oe2403sp2 |
mod_security_crsopenEuler:24.03-LTS-SP3 |
before 3.3.5-3.oe2403sp3 | 3.3.5-3.oe2403sp3 |
mod_security_crsopenEuler:22.03-LTS-SP3 |
before 3.2.2-3.oe2203sp3 | 3.2.2-3.oe2203sp3 |
mod_security_crsopenEuler:22.03-LTS-SP4 |
before 3.2.2-3.oe2203sp4 | 3.2.2-3.oe2203sp4 |
mod_security_crsopenEuler:24.03-LTS |
before 3.3.5-3.oe2403 | 3.3.5-3.oe2403 |
mod_security_crsopenEuler:24.03-LTS-SP1 |
before 3.3.5-3.oe2403sp1 | 3.3.5-3.oe2403sp1 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mod_security_crsopenEuler:20.03-LTS-SP4 |
before 3.2.2-3.oe2003sp4 | 3.2.2-3.oe2003sp4 |
modsecurity-crsUbuntu:16.04:LTS |
All versions, plus listed versions 2.2.9-1 |
None known |
modsecurity-crsUbuntu:18.04:LTS |
All versions, plus listed versions 3.0.0-33.0.2-1 |
None known |
modsecurity-crsUbuntu:20.04:LTS |
All versions, plus listed versions 3.1.1-13.2.0-1 |
None known |
modsecurity-crsUbuntu:22.04:LTS |
All versions, plus listed versions 3.3.0-13.3.2-1 |
None known |
modsecurity-crsUbuntu:24.04:LTS |
All versions, plus listed versions 3.3.5-13.3.5-2 |
None known |
modsecurity-crsUbuntu:25.10 |
All versions, plus listed versions 3.3.7-1 |
None known |
modsecurity-crsUbuntu:26.10 |
All versions, plus listed versions 3.3.8-13.3.9-1 |
None known |
modsecurity-crsUbuntu:26.04:LTS |
All versions, plus listed versions 3.3.7-13.3.8-1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | coreruleset 4.21.0 - Firewall Bypass | 2026-05-13 |
| PoC in GitHub | CVEs-Labs/CVE-2026-21876 | 2026-04-22 |
| PoC in GitHub | Mefhika120/CVE-2026-21876 | 2026-01-25 |
| PoC in GitHub | daytriftnewgen/CVE-2026-21876 | 2026-06-06 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, Exploit-DB, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-21876 is a critical vulnerability (CVSS 9.3) in Coreruleset, published January 8, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 17.7%, the 97th percentile. Fixed in modsecurity-crs 3.3.4-1+deb12u1.
References
github.com/coreruleset/coreruleset/security/advisories/GHSA-36fv-25j3-r2c5
Show 12 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-21876
security-tracker.debian.org/tracker/CVE-2026-21876
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-1103
ubuntu.com/security/CVE-2026-21876
cve.org/CVERecord?id=CVE-2026-21876