Skip to content
OpenAdvisories
Critical DSA-6105-1 1 CVE

modsecurity-crs - security update

Published Jan 21, 2026 · Updated Jan 21, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 12 modsecurity-crs 3.3.4-1+deb12u1
Debian · 13 modsecurity-crs 3.3.7-1+deb13u1

Vulnerabilities 1

  • Critical 9.3
    CVE-2026-21876 Public exploit EPSS 17%

    OWASP CRS has multipart bypass using multiple content-type parts

    The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the …

    coreruleset coreruleset modsecurity-crs modsecurity-crs Debian Ubuntu