CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-21876

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.001

EPSS Ranking 17.0%

CVSS Severity

CVSS v3 Score 9.3

References

Products affected by CVE-2026-21876

Owasp » Owasp Modsecurity Core Rule Set » Version: Any

cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:*
Owasp » Owasp Modsecurity Core Rule Set » Version: 2.2.5

cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:2.2.5
Owasp » Owasp Modsecurity Core Rule Set » Version: 2.2.6

cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:2.2.6
Owasp » Owasp Modsecurity Core Rule Set » Version: 2.2.7

cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:2.2.7
Owasp » Owasp Modsecurity Core Rule Set » Version: 2.2.8

cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:2.2.8
Owasp » Owasp Modsecurity Core Rule Set » Version: 2.2.9

cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:2.2.9
Owasp » Owasp Modsecurity Core Rule Set » Version: 3.0.0

cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:3.0.0
Owasp » Owasp Modsecurity Core Rule Set » Version: 3.0.1

cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:3.0.1
Owasp » Owasp Modsecurity Core Rule Set » Version: 3.0.2

cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:3.0.2
Owasp » Owasp Modsecurity Core Rule Set » Version: 3.1.0

cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:3.1.0
Owasp » Owasp Modsecurity Core Rule Set » Version: 3.1.1

cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:3.1.1
Owasp » Owasp Modsecurity Core Rule Set » Version: 3.1.2

cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:3.1.2
Owasp » Owasp Modsecurity Core Rule Set » Version: 3.2.0

cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:3.2.0
Owasp » Owasp Modsecurity Core Rule Set » Version: 3.2.1

cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:3.2.1
Owasp » Owasp Modsecurity Core Rule Set » Version: 3.3.0

cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:3.3.0
Owasp » Owasp Modsecurity Core Rule Set » Version: 3.3.1

cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:3.3.1
Owasp » Owasp Modsecurity Core Rule Set » Version: 3.3.2

cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:3.3.2

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-21876

Products

Pricing

Contact Us