Skip to content
OpenAdvisories
Medium ALAS2023-2026-1562 1 CVE

Moderate: mod_security_crs security update (Amazon Linux 2023)

Published Apr 13, 2026 · Updated Apr 13, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33691: Whitespace padding in filenames bypasses file upload extension checks NOTE: https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2023 mod_security_crs 0:4.2.0-1.amzn2023.0.3

Vulnerabilities 1

  • Medium 6.8
    CVE-2026-33691

    OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks

    The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .…

    coreruleset coreruleset modsecurity-crs modsecurity-crs Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-33691.html