EUVD-2026-43047Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Remote unauthenticated multipart request, no user interaction (AV:N/AC:L/PR:N/UI:N); scope changes to the protected backend (S:C) whose integrity is undermined by the bypass (I:H), with no confidentiality or availability loss.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead of appending the current buffer. This creates a parser differential between ModSecurity and backend applications that preserve line breaks in form fields, allowing rules that inspect ARGS or ARGS_POST to miss payloads whose dangerous syntax depends on a line break. This issue is fixed in version 3.0.16.
Articles & Coverage 1
AnalysisAI
WAF filtering bypass in OWASP ModSecurity (libmodsecurity) before 3.0.16 lets remote unauthenticated attackers smuggle malicious payloads past inspection rules by exploiting a multipart/form-data parser differential. The engine silently strips embedded line breaks from non-file form-field values before populating ARGS and ARGS_POST, so any rule whose detection depends on a newline (e.g. command, header, or injection syntax spanning a line break) fails to match while the backend still receives and acts on the intact payload. No public exploit identified at time of analysis, but the CVSS base score of 8.6 reflects a scope-changing integrity impact on every application shielded by an affected deployment.
Technical ContextAI
ModSecurity is the most widely used open-source web application firewall engine, embedded as a module in Apache httpd, IIS and Nginx and serving as the runtime for the OWASP Core Rule Set. The defect lives in src/request_body_processor/multipart.cc, which reconstructs the value of each multipart part. When flushing buffered bytes it overwrites the reserved bytes held in m_reserve instead of appending the current buffer, causing embedded CR/LF sequences inside a non-file form-field value to be dropped before the value is exported to the ARGS and ARGS_POST collections. The root cause maps to CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize): ModSecurity normalizes the field value in a way that diverges from how the protected backend parses the same raw multipart body, and rules validate the normalized-and-corrupted view rather than the bytes the application will actually consume. The affected component is cpe:2.3:a:owasp-modsecurity:modsecurity across all versions prior to 3.0.16.
RemediationAI
Vendor-released patch: 3.0.16 - upgrade libmodsecurity to version 3.0.16 or later and reload the Apache/IIS/Nginx worker so the fixed multipart parser is loaded, per release https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.16 and advisory https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-rcw9-2f5r-7p88. If immediate upgrade is not possible, reduce reliance on the corrupted ARGS/ARGS_POST view: add rules that inspect the raw request body (e.g. REQUEST_BODY and MULTIPART_* variables plus strict multipart validation such as MULTIPART_STRICT_ERROR) so detection does not depend solely on the line-break-stripped field values, and consider rejecting or flagging multipart/form-data submissions that contain embedded CR/LF in non-file fields - noting this can generate false positives for legitimate multi-line textarea inputs. Where an endpoint does not require multipart uploads, restrict or disable multipart body processing on that route as temporary containment, accepting the trade-off that legitimate file-upload functionality on those endpoints will break.
More in Modsecurity
View allLibmodsecurity is one component of the ModSecurity v3 project. Rated high severity (CVSS 7.9), this vulnerability is rem
ModSecurity versions prior to 2.9.10 contain a denial of service vulnerability in the `sanitiseArg` and `sanitizeArg` ac
ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Rated high severity (CVSS 7.5), this vulnerabi
Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. Rated high severity (CVSS 7.5),
The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver ar
ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. Rated medium severity (CVSS 6.1), this vulnerabili
The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NUL
apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer codi
ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cau
Remote denial of service in OWASP ModSecurity (libmodsecurity3) 3.0.0 through 3.0.14 allows unauthenticated attackers to
Worker process crashes occur in ModSecurity (libmodsecurity3) when processing query string parameters containing single
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today