CVE-2026-21876: The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8…

PriorityP350medium5.3CVSS 3.1

AVNACLPRNUINSUCNILAN

EXPLOIT

EPSS

13.12%

95.9th percentile

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
coreruleset	coreruleset	< 4.22.0	4.22.0
coreruleset	coreruleset	< 3.3.8	3.3.8
debian	modsecurity-crs	< modsecurity-crs 3.3.4-1+deb12u1 (bookworm)	modsecurity-crs 3.3.4-1+deb12u1 (bookworm)
owasp	owasp_modsecurity_core_rule_set	< 3.3.8	3.3.8
owasp	owasp_modsecurity_core_rule_set	>= 4.0.0 < 4.22.0	4.22.0

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

osv5.3MEDIUM

vendor_debian9.3CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.