Incomplete filtering of multiple instances of special elements in OWASP ModSecurity Core Rule Set (CRS) - CVE-2026-21876

Detailed vulnerability description

The vulnerability allows a remote attacker to bypass security rules.

The vulnerability exists due to improper input validation of multiplart requests in rule 922110. When the first rule in a chain iterates over a collection (like MULTIPART_PART_HEADERS), the capture variables (TX:0, TX:1) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. A remote non-authenticated attacker can bypass ModSecurity rule and send malicious requests to the application. 

How to mitigate CVE-2026-21876

Sources

• https://github.com/coreruleset/coreruleset/security/advisories/GHSA-36fv-25j3-r2c5