CVE-2026-52747
published 2026-07-10CVE-2026-52747: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request…
PriorityP350high8.6CVSS 3.1
AVNACLPRNUINSCCNIHAN
EPSS
0.48%
39.7th percentile
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead of appending the current buffer. This creates a parser differential between ModSecurity and backend applications that preserve line breaks in form fields, allowing rules that inspect ARGS or ARGS_POST to miss payloads whose dangerous syntax depends on a line break. This issue is fixed in version 3.0.16.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mod_security | mod_security | — | — |
| owasp-modsecurity | modsecurity | < 3.0.16 | 3.0.16 |
| owasp | modsecurity | < 3.0.16 | 3.0.16 |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
vendor_redhat8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ModSecurity: ModSecurity: Security rule bypass due to incorrect handling of line breaks in form data
vendor_redhat·2026-07-10·CVSS 8.6
CVE-2026-52747 [HIGH] CWE-179 ModSecurity: ModSecurity: Security rule bypass due to incorrect handling of line breaks in form data
ModSecurity: ModSecurity: Security rule bypass due to incorrect handling of line breaks in form data
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead of appending the current buffer. This creates a parser differential between ModSecurity and backend applications that preserve line breaks in form fields, allowing rules that inspect ARGS or ARGS_POST to miss payloads whose dangerous syntax depends on a line break. This issue is fixed in version 3.
VulDB
owasp-modsecurity ModSecurity up to 3.0.15 Request Body Parser multipart.cc cross site scripting
vuldb·2026-07-11·CVSS 8.6
CVE-2026-52747 [HIGH] owasp-modsecurity ModSecurity up to 3.0.15 Request Body Parser multipart.cc cross site scripting
A vulnerability identified as problematic has been detected in owasp-modsecurity ModSecurity up to 3.0.15. Impacted is an unknown function of the file src/request_body_processor/multipart.cc of the component Request Body Parser. This manipulation causes cross site scripting.
This vulnerability is handled as CVE-2026-52747. The attack can be initiated remotely. There is not any exploit available.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-52747 mod_security: ModSecurity: Security rule bypass due to incorrect handling of line breaks in form data [epel-all]
bugzilla·2026-07-11·CVSS 8.6
CVE-2026-52747 [HIGH] CVE-2026-52747 mod_security: ModSecurity: Security rule bypass due to incorrect handling of line breaks in form data [epel-all]
CVE-2026-52747 mod_security: ModSecurity: Security rule bypass due to incorrect handling of line breaks in form data [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead of appending the current buffer. This creates a
Bugzilla
CVE-2026-52747 libmodsecurity: ModSecurity: Security rule bypass due to incorrect handling of line breaks in form data [epel-all]
bugzilla·2026-07-11·CVSS 8.6
CVE-2026-52747 [HIGH] CVE-2026-52747 libmodsecurity: ModSecurity: Security rule bypass due to incorrect handling of line breaks in form data [epel-all]
CVE-2026-52747 libmodsecurity: ModSecurity: Security rule bypass due to incorrect handling of line breaks in form data [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead of appending the current buffer. This creates
Bugzilla
CVE-2026-52747 libmodsecurity: ModSecurity: Security rule bypass due to incorrect handling of line breaks in form data [fedora-all]
bugzilla·2026-07-11·CVSS 8.6
CVE-2026-52747 [HIGH] CVE-2026-52747 libmodsecurity: ModSecurity: Security rule bypass due to incorrect handling of line breaks in form data [fedora-all]
CVE-2026-52747 libmodsecurity: ModSecurity: Security rule bypass due to incorrect handling of line breaks in form data [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead of appending the current buffer. This creat
Bugzilla
CVE-2026-52747 mod_security: ModSecurity: Security rule bypass due to incorrect handling of line breaks in form data [fedora-all]
bugzilla·2026-07-11·CVSS 8.6
CVE-2026-52747 [HIGH] CVE-2026-52747 mod_security: ModSecurity: Security rule bypass due to incorrect handling of line breaks in form data [fedora-all]
CVE-2026-52747 mod_security: ModSecurity: Security rule bypass due to incorrect handling of line breaks in form data [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead of appending the current buffer. This creates
Bugzilla
CVE-2026-52747 ModSecurity: ModSecurity: Security rule bypass due to incorrect handling of line breaks in form data
bugzilla·2026-07-10·CVSS 8.6
CVE-2026-52747 [HIGH] CVE-2026-52747 ModSecurity: ModSecurity: Security rule bypass due to incorrect handling of line breaks in form data
CVE-2026-52747 ModSecurity: ModSecurity: Security rule bypass due to incorrect handling of line breaks in form data
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead of appending the current buffer. This creates a parser differential between ModSecurity and backend applications that preserve line breaks in form fields, allowing rules that inspect ARGS or ARGS_POST to miss payloads whose dangerous syntax depends on a line break. This issue is fixe
Hackernews
⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
blogs_hackernews·2026-07-13
CVE-2026-50746 ⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
Somewhere right now, a security tool is quietly finding bugs faster than any human can fix them. That's supposed to be the good news. The catch is that the attackers have the same tools, pointed the other way, and they don't file tickets.
That's the shape of this week. Trusted code turns on the people who installed it. Old bugs from last year are still landing because the fix sat in a queue too long. Fake installers, poisoned packages, systems left facing the open internet, and helpful little AI assistants running instructions that were
https://github.com/owasp-modsecurity/ModSecurity/commit/875504c2758169c41be1ad2f0cc64d896b7815d7https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.16https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-rcw9-2f5r-7p88https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-rcw9-2f5r-7p88
2026-07-10
Published