PT-2026-2115 · Coraza+3 · Coraza+3

Daytriftnewgen · Published 2026-01-08 · Updated 2026-05-01 · CVE-2026-21876

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions OWASP Core Rule Set versions prior to 4.22.0 OWASP Core Rule Set versions prior to 3.3.8

Description A bug in rule 922110 occurs when processing multipart requests containing multiple parts. When the first rule in a chain iterates over a collection, such as MULTIPART PART HEADERS, the capture variables TX:0 and TX:1 are overwritten during each iteration. Consequently, only the last captured value is available to the chained rule. This allows attackers to bypass charset validation by placing a malicious charset (e.g., UTF-7 for XSS) in an early part of the request and a legitimate charset in a subsequent part, causing the WAF to overlook the malicious payload.

Recommendations Update to version 4.22.0. Update to version 3.3.8. As a temporary workaround, consider disabling rule 922110, although this weakens overall protection.

Exploit

Fix

Weakness Enumeration

CWE-794

Related Identifiers

CVE-2026-21876

GHSA-36FV-25J3-R2C5

OESA-2026-1103

OESA-2026-1104

OESA-2026-1105

OESA-2026-1106

OESA-2026-1107

OESA-2026-1108

OESA-2026-1573

Affected Products

Coraza

Debian

Modsecurity

Owasp Core Rule Set

References · 71

• 🔥 https://github.com/coreruleset/coreruleset/security/advisories/GHSA-36fv-25j3-r2c5 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21876.json · Exploit
• 🔥 https://github.com/daytriftnewgen/CVE-2026-21876 · Exploit
• 🔥 https://exploit-db.com/exploits/52558 · Exploit
• https://github.com/coreruleset/coreruleset/commit/80d80473abf71bd49bf6d3c1ab221e3c74e4eb83 · Patch
• https://github.com/coreruleset/coreruleset/commit/9917985de09a6cf38b3261faf9105e909d67a7d6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-21876 · Security Note
• https://ubuntu.com/security/CVE-2026-21876 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1108 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1573 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-21876 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21876 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-21876 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1104 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-21876 · Vendor Advisory