Is CVE-2026-52747 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52747 being exploited in the wild.

How severe is CVE-2026-52747?

High severity, with a CVSS score of 8.6, published 10 July 2026.

Is there a fix for CVE-2026-52747?

A patch was published on 2026-06-29: Version 3.0.16 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-52747 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-52747?

Check whether you run OWASP Modsecurity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52747: OWASP ModSecurity WAF bypass via line break stripping in multipart parser

CVE-2026-52747 · Severity: high · CVSS 8.6 · Published 2026-07-10

ModSecurity is a widely used web application firewall (WAF) that protects websites by inspecting incoming traffic for malicious activity. A flaw in how it processes certain web forms (multipart/form-data) causes it to accidentally strip out line breaks from submitted data. This allows attackers to bypass security rules by hiding malicious code within data that relies on those line breaks to be detected, potentially leaving the backend web server exposed to attacks that the WAF was intended to block.

Technologies: OWASP Modsecurity. Vendors: OWASP.

Quick answers

Is CVE-2026-52747 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52747 being exploited in the wild.
How severe is CVE-2026-52747?: High severity, with a CVSS score of 8.6, published 10 July 2026.
Which products and versions are affected?: OWASP Modsecurity < 3.0.16.
Is there a fix for CVE-2026-52747?: A patch was published on 2026-06-29: Version 3.0.16 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52747 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-52747?: Check whether you run OWASP Modsecurity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the multipart/form-data request body parser of libmodsecurity prior to version 3.0.16. The root cause is located in `src/request_body_processor/multipart.cc`, where the parser overwrites reserved bytes in `m_reserve` instead of appending the current buffer when processing non-file form-data. This results in the silent removal of CRLF/LF characters from form-field values before they are exported to the `ARGS` and `ARGS_POST` variables. Because backend applications typically preserve these line breaks, a parser differential is created. Attackers can exploit this to smuggle payloads that require line breaks for specific syntax (e.g., certain SQL injection or XSS patterns) past ModSecurity rules that would otherwise detect them. The issue is fixed in version 3.0.16.

Affected products

OWASP ModSecurity (libmodsecurity) < 3.0.16

Timeline

2026-06-29: patched: Version 3.0.16 released
2026-06-29: advisory: GitHub Security Advisory GHSA-rcw9-2f5r-7p88 published
2026-07-10: disclosed: CVE-2026-52747 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.