Skip to content
OpenAdvisories
Critical DLA-4488-1 2 CVEs

modsecurity-crs - security update

Published Feb 22, 2026 · Updated Feb 22, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 modsecurity-crs 3.3.4-1~deb11u2

Vulnerabilities 2

  • Critical 9.3
    CVE-2026-21876 Public exploit EPSS 17%

    OWASP CRS has multipart bypass using multiple content-type parts

    The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the …

    coreruleset coreruleset modsecurity-crs modsecurity-crs Debian Ubuntu
  • Unscored —
    CVE-2023-38199

    coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers o…

    modsecurity-crs modsecurity-crs Debian Ubuntu