CVE-2026-52747
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
ModSecurity before version 3.0.16 has a vulnerability in the multipart/form-data parser that silently removes line breaks from non-file form-field values. This occurs because the code overwrites reserved bytes instead of appending the current buffer, causing a parser differential between ModSecurity and backend applications.
Risk Assessment
The risk is that WAF rules inspecting ARGS or ARGS_POST may miss malicious payloads whose dangerous syntax depends on a line break. Attackers can exploit this to bypass security controls and execute attacks such as code injection.
Recommendation
Immediately upgrade ModSecurity to version 3.0.16 or later, which includes a fix for this vulnerability.
Other vulnerabilities in ModSecurity
See all- CVE-2026-42268High
ModSecurity is a web application firewall engine that from versions 3.0.0 to before 3.0.15 contains an unhandled exception caused by unsigned integer underflow. This issue occurs when the administrator uses the @verifySSN, @verifyCPF, or @verifySVNR rule.
- CVE-2026-52761Medium
A vulnerability in ModSecurity versions 3.0.0 through 3.0.15 affects the t:utf8toUnicode transformation on i386 architecture. The snprintf function uses the size of a pointer instead of the Unicode buffer length, causing incorrect output and allowing WAF rule bypass.
- CVE-2023-38285High
ModSecurity 3.x before 3.0.10 has an issue with inefficient algorithmic complexity.
Original NVD description (English source)
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead of appending the current buffer. This creates a parser differential between ModSecurity and backend applications that preserve line breaks in form fields, allowing rules that inspect ARGS or ARGS_POST to miss payloads whose dangerous syntax depends on a line break. This issue is fixed in version 3.0.16.