Skip to content
Owasp Modsecurity Core Rule Set vulnerabilities
-
coreruleset, owasp modsecurity core rule set +1 more
OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks
CVE-2026-33691
Fix available
6.8 Medium
-
coreruleset, owasp modsecurity core rule set +1 more
OWASP CRS has multipart bypass using multiple content-type parts
CVE-2026-21876
Public exploitFix available
EPSS 17.3%
9.3 Critical
-
owasp modsecurity core rule set, debian linux, fedoraproject fedora +2 more
Response body bypass in OWASP ModSecurity Core Rule Set via repeated HTTP Range header submission with a small byte range
CVE-2022-39958
Fix available
7.5 High
-
owasp modsecurity core rule set, debian linux, fedoraproject fedora +2 more
Response body bypass in OWASP ModSecurity Core Rule Set via a specialy crafted charset in the HTTP Accept header
CVE-2022-39957
Fix available
7.3 High
-
owasp modsecurity core rule set, debian linux, fedoraproject fedora +2 more
Partial rule set bypass in OWASP ModSecurity Core Rule Set for HTTP multipart requests using character encoding in the Content-Type or Content-Transfer-Encoding header
CVE-2022-39956
Fix available
7.3 High
-
owasp modsecurity core rule set, debian linux, fedoraproject fedora +2 more
Partial rule set bypass in OWASP ModSecurity Core Rule Set by submitting a specially crafted HTTP Content-Type header
CVE-2022-39955
Fix available
7.3 High
-
debian linux, owasp modsecurity core rule set +1 more
Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass...
CVE-2020-22669
Fix available
9.8 Critical
-
owasp modsecurity core rule set, debian linux, fedoraproject fedora +2 more
OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is...
CVE-2021-35368
Fix available
9.8 Critical
-
owasp modsecurity core rule set
A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp...
CVE-2018-16384
Fix available
7.5 High