CVE-2026-52747

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead of appending the current buffer. This creates a parser differential between ModSecurity and backend applications that preserve line breaks in form fields, allowing rules that inspect ARGS or ARGS_POST to miss payloads whose dangerous syntax depends on a line break. This issue is fixed in version 3.0.16.

• CWE-180

• https://github.com/owasp-modsecurity/ModSecurity/commit/875504c2758169c41be1ad2f0cc64d896b7815d7Patch
• https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.16Product, Release Notes
• https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-rcw9-2f5r-7p88Exploit, Mitigation, Vendor Advisory
• https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-rcw9-2f5r-7p88Exploit, Mitigation, Vendor Advisory

Published

Jul 10, 2026

Last Modified

Jul 14, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52722A signed integer overflow vulnerability was found in GStream…7.1
• CVE-2026-52725Angular is a development platform for building mobile and de…6.1
• CVE-2026-52726Dulwich is a pure-Python implementation of the Git file form…7.5
• CVE-2026-5273Use after free in CSS in Google Chrome prior to 146.0.7680.1…6.3
• CVE-2026-5274Integer overflow in Codecs in Google Chrome prior to 146.0.7…8.8
• CVE-2026-52746JSONata is a JSON query and transformation language. Prior t…7.5
• CVE-2026-5275Heap buffer overflow in ANGLE in Google Chrome on Mac prior …8.8
• CVE-2026-52750Ghidra before 12.1 contains a command injection vulnerabilit…8.4
• CVE-2026-52751Ghidra before 12.1 contains an unsafe deserialization vulner…8.8
• CVE-2026-52752Ghidra before 12.0.2 contains a path traversal vulnerability…8.4
• CVE-2026-52753Ghidra before 12.0.3 contains an out-of-memory vulnerability…6.7
• CVE-2026-52754Ghidra before 12.1 contains an authentication bypass vulnera…8.8