CVE-2026-44982

HighCVSS 7.2

Published: 16/07/2026(UTC)Updated: 17/07/2026(UTC)Translated: 18/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

A vulnerability in CrowdSec from version 1.5.0 to 1.7.8 causes HTTP/1.1 requests with Transfer-Encoding: chunked and HTTP/2 requests without a Content-Length header to be processed with an empty request body buffer. As a result, WAF rules targeting REQUEST_BODY, BODY_ARGS, ARGS_POST, JSON, or XML are skipped.

Risk Assessment

The organization is at risk of WAF rule bypass for requests with body data, potentially allowing attackers to send malicious payloads undetected by the protection system.

Recommendation

Update CrowdSec to version 1.7.8 or later immediately, which includes a fix for this vulnerability.

Other vulnerabilities in CrowdSec

CVE-2026-44981High
CrowdSec versions 1.7.0 through 1.7.8 have a vulnerability in the LAPI router that globally uses gin-contrib/gzip with DefaultDecompressHandle. This decompresses unauthenticated gzip-compressed JSON request bodies without enforcing a maximum decompressed size, allowing excessive heap allocation that can make LAPI unreachable.

Original NVD description (English source)

CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from max(r.ContentLength, 0), so HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests without a content-length header produced an empty body and caused WAF rules targeting REQUEST_BODY, BODY_ARGS, ARGS_POST, JSON, or XML to be skipped. This issue is fixed in version 1.7.8.