PT-2026-44131 · Crowdsec · Crowdsec

CVE-2026-44982 · Published 2026-05-27 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions crowdsec versions prior to 1.7.8

Description The AppSec component fails to read the HTTP request body when the Content-Length is not positive. This occurs specifically with HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests sent without a content-length header. The issue resides in the NewParsedRequestFromRequest() function within pkg/appsec/request.go. Because the request body is read as empty, any WAF rule targeting REQUEST BODY, BODY ARGS, ARGS POST, JSON, or XML fails to match. An unauthenticated remote attacker can bypass the body-inspection pipeline by modifying a framing header, allowing malicious requests to be forwarded without triggering WAF log entries. Header-only and URI-only rules remain unaffected.

Recommendations Update to a version newer than 1.7.7.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2026-44982

GHSA-RW47-HM26-6WR7

GO-2026-5641

OPENSUSE-SU-2026:21483-1

Affected Products

Crowdsec

References · 1749

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44982.json · Exploit
• https://ubuntu.com/security/CVE-2026-44982 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rw47-hm26-6wr7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44982 · Security Note
• https://osv.dev/vulnerability/GO-2026-5641 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-44982 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-44982 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-44982 · Vendor Advisory
• https://github.com/crowdsecurity/crowdsec/commit/3d5c4d9b127091e9063b9b5eb785372a599a4435 · Note
• https://github.com/crowdsecurity/crowdsec/security/advisories/GHSA-rw47-hm26-6wr7 · Note
• https://github.com/crowdsecurity/crowdsec/commit/57a793548671e6bbd2cde5562fe87b856ec9c642 · Note
• https://github.com/crowdsecurity/crowdsec/pull/4355 · Note
• https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.8 · Note
• https://github.com/crowdsecurity/crowdsec · Note