CVE-2026-52747

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-52747
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52747.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-52747
Aliases
Downstream
Published
2026-07-10T21:42:11.503Z
Modified
2026-08-12T16:25:43.169595Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N CVSS Calculator
Summary
ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass
Details

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGSPOST because src/requestbodyprocessor/multipart.cc overwrites reserved bytes in mreserve instead of appending the current buffer. This creates a parser differential between ModSecurity and backend applications that preserve line breaks in form fields, allowing rules that inspect ARGS or ARGS_POST to miss payloads whose dangerous syntax depends on a line break. This issue is fixed in version 3.0.16.

Database specific 
{
    "cwe_ids": [
        "CWE-180"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52747.json"
}
References

Affected packages

Git / github.com/owasp-modsecurity/modsecurity

Affected ranges

Type
GIT
Repo
https://github.com/owasp-modsecurity/modsecurity
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7ea9fefbe0ba409d8733b4d682c8c4c059cd028d
Fixed
875504c2758169c41be1ad2f0cc64d896b7815d7
Database specific
Show details 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:owasp:modsecurity:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.0.16"
        }
    ]
}

Affected versions

v2.*
v2.7.4
v2.9.0
v2.9.0-rc1
v2.9.0-rc2
v3.*
v3.0.0
v3.0.0-rc1
v3.0.1
v3.0.10
v3.0.11
v3.0.12
v3.0.13
v3.0.14
v3.0.15
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.0.8
v3.0.9
v4.*
v4.0.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52747.json"
vanir_signatures 
[
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "172847367914163763902577858060215230369",
                "119965025624261581467155950682354886311",
                "86117948540492774593304806802312181345",
                "178709695677534367470416503912221656507",
                "250512267671779956602397810641455197126"
            ]
        },
        "target": {
            "file": "src/request_body_processor/multipart.cc"
        },
        "source": "https://github.com/owasp-modsecurity/modsecurity/commit/875504c2758169c41be1ad2f0cc64d896b7815d7",
        "signature_version": "v1",
        "id": "CVE-2026-52747-1d33b0e4",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "94198314872370756934385654425389990914",
            "length": 5163.0
        },
        "target": {
            "function": "Multipart::process_part_data",
            "file": "src/request_body_processor/multipart.cc"
        },
        "source": "https://github.com/owasp-modsecurity/modsecurity/commit/875504c2758169c41be1ad2f0cc64d896b7815d7",
        "signature_version": "v1",
        "id": "CVE-2026-52747-354231a5",
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-08-12T16:25:43Z"