Known vulnerabilities in OWASP ModSecurity Core Rule Set (CRS)

Vendor: OWASP
Software CPE: cpe:2.3:a:owasp:coreruleset:*:*:*:*:*:modsecurity:*:*
Website:
Total vulnerabilities: 12
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting OWASP ModSecurity Core Rule Set (CRS) OWASP ModSecurity Core Rule Set (CRS) is affected by 12 known vulnerabilities: 1 high, 11 medium Critical High Medium Low

Vulnerabilities (12)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU136863 - Improper Neutralization of Special Elements
CWE-138 Medium
No
No
3.3.10, 4.25.1, 4.28.0 03.07.2026 SB2026070343
#VU136862 - Inefficient Regular Expression Complexity
CWE-1333 High
No
No
3.3.10, 4.25.1, 4.28.0 03.07.2026 SB2026070343
#VU126712 - Improper Handling of Case Sensitivity
CVE-2026-33691
CWE-178 Medium
No
No
3.3.9, 4.25.0 21.04.2026 SB2026042189
SB2026060530
SB2026060531
#VU121073 - Incomplete Filtering of Multiple Instances of Special Elements
CVE-2026-21876
CWE-794 Medium
No
No
3.3.8, 4.22.0 07.01.2026 SB2026010786
SB2026011694
SB2026011695
and 8 more
#VU78624 - Type confusion
CVE-2023-38199
CWE-843 Medium
No
No
3.3.5 25.07.2023 SB2023072508
#VU72100 - Incorrect Regular Expression
CVE-2019-11387
CWE-185 Medium
No
No
3.1.1 09.02.2023 SB2019072816
#VU72099 - Improper input validation
CVE-2019-13464
CWE-20 Medium
No
No
3.2.0 09.02.2023 SB2019070929
#VU72091 - Improper input validation
CVE-2022-39958
CWE-20 Medium
No
No
3.2.3, 3.3.4 09.02.2023 SB2023020956
SB2023052103
SB2022093048
and 3 more
#VU72090 - Improper input validation
CVE-2022-39957
CWE-20 Medium
No
No
3.2.3, 3.3.4 09.02.2023 SB2023020956
SB2023052103
SB2022093048
and 3 more
#VU72089 - Improper input validation
CVE-2022-39956
CWE-20 Medium
No
No
3.2.3, 3.3.4 09.02.2023 SB2023020956
SB2023052103
SB2023060906
and 14 more
#VU72087 - Improper input validation
CVE-2022-39955
CWE-20 Medium
No
No
3.2.3, 3.3.4 09.02.2023 SB2023020956
SB2023052103
SB2022092752
and 3 more
#VU54495 - Protection Mechanism Failure
CVE-2021-35368
CWE-693 Medium
No
No
3.1.2, 3.2.1, 3.3.2 01.07.2021 SB2021070111
SB2021070112
SB2021070807
and 4 more