Executive brief
ModSecurity is a widely used web application firewall (WAF) that protects websites by inspecting incoming traffic for malicious activity. A flaw in how it processes certain web forms (multipart/form-data) causes it to accidentally strip out line breaks from submitted data. This allows attackers to bypass security rules by hiding malicious code within data that relies on those line breaks to be detected, potentially leaving the backend web server exposed to attacks that the WAF was intended to block.
Technical details
A vulnerability exists in the multipart/form-data request body parser of libmodsecurity prior to version 3.0.16. The root cause is located in `src/request_body_processor/multipart.cc`, where the parser overwrites reserved bytes in `m_reserve` instead of appending the current buffer when processing non-file form-data. This results in the silent removal of CRLF/LF characters from form-field values before they are exported to the `ARGS` and `ARGS_POST` variables. Because backend applications typically preserve these line breaks, a parser differential is created. Attackers can exploit this to smuggle payloads that require line breaks for specific syntax (e.g., certain SQL injection or XSS patterns) past ModSecurity rules that would otherwise detect them. The issue is fixed in version 3.0.16.
Affected products
- OWASP ModSecurity (libmodsecurity) < 3.0.16
Timeline
- 2026-06-29: patched: Version 3.0.16 released
- 2026-06-29: advisory: GitHub Security Advisory GHSA-rcw9-2f5r-7p88 published
- 2026-07-10: disclosed: CVE-2026-52747 published to NVD