CVE-2026-21876
Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 17.7%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 17.75% probability · 97th percentile
- Public exploits
- 1 in Exploit-DB · first 13 May 2026
- CISA KEV
- Not listed
- Weakness
- CWE-794
- Affected
- owasp/owasp modsecurity core rule set
- Source
- security-advisories@github.com
EPSS 17.7% since 30 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
Public exploits (1)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
References
- https://github.com/coreruleset/coreruleset/commit/80d80473abf71bd49bf6d3c1ab221e3c74e4eb83Patch
- https://github.com/coreruleset/coreruleset/commit/9917985de09a6cf38b3261faf9105e909d67a7d6Patch
- https://github.com/coreruleset/coreruleset/releases/tag/v3.3.8Product, Release Notes
- https://github.com/coreruleset/coreruleset/releases/tag/v4.22.0Product, Release Notes
- https://github.com/coreruleset/coreruleset/security/advisories/GHSA-36fv-25j3-r2c5Exploit, Vendor Advisory
- https://github.com/daytriftnewgen/CVE-2026-21876
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.