CVE catalog

CVE-2026-52747

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently r

[CVE catalog]

Severity
High · CVSS 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.48% · Oct 25, 2026

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead of appending the current buffer. This creates a parser differential between ModSecurity and backend applications that preserve line breaks in form fields, allowing rules that inspect ARGS or ARGS_POST to miss payloads whose dangerous syntax depends on a line break. This issue is fixed in version 3.0.16.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmodsecuritysid3.0.16-1fixed
Debianmodsecurityforky3.0.16-1fixed
Debianmodsecuritytrixie3.0.14-1+deb13u1vulnerable
Debianmodsecuritybookworm3.0.9-1+deb12u2vulnerable
CpemodsecurityNot reportedNot reportedvulnerable
CpemodsecurityNot reported3.0.16fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmodsecuritysourcesid3.0.16-1not yet assignedNot reported[1141961]
Debianmodsecuritysourceforky3.0.16-1not yet assignedNot reported[1141961]
Debianmodsecuritysourcetrixie(unfixed)not yet assignedNot reported[1141961]
Debianmodsecuritysourcebookworm(unfixed)not yet assignedNot reported[1141961]
CpemodsecuritycpeNot reported3.0.16Not reportedNVD-CVE-2026-52747Not reported

[Debian bug #1141961]

Notes

[trixie] modsecurity: Minor issue; will be fixed via point release [bookworm] modsecurity: Minor issue; multipart parser differential, WAF-rule bypass only

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libmodsecurity3]Affected

    Source package: [modsecurity]

    Details (2)

    • 3.0.9-1+deb12u2 · amd64 · bookworm

      Affected

      nvd · modsecurity · debian · bookworm; nvd · modsecurity · debian · 12

    • 3.0.9-1+deb12u2 · arm64 · bookworm

      Affected

      nvd · modsecurity · debian · bookworm; nvd · modsecurity · debian · 12

  • [libmodsecurity-dev]Affected

    Source package: [modsecurity]

    Details (2)

    • 3.0.9-1+deb12u2 · amd64 · bookworm

      Affected

      nvd · modsecurity · debian · bookworm; nvd · modsecurity · debian · 12

    • 3.0.9-1+deb12u2 · arm64 · bookworm

      Affected

      nvd · modsecurity · debian · bookworm; nvd · modsecurity · debian · 12

[Debian 13 (Trixie)]

  • [libmodsecurity3t64]Affected

    Source package: [modsecurity]

    Details (2)

    • 3.0.14-1+deb13u1 · amd64 · trixie

      Affected

      nvd · modsecurity · debian · 13

    • 3.0.14-1+deb13u1 · arm64 · trixie

      Affected

      nvd · modsecurity · debian · 13

  • [libmodsecurity-dev]Affected

    Source package: [modsecurity]

    Details (2)

    • 3.0.14-1+deb13u1 · amd64 · trixie

      Affected

      nvd · modsecurity · debian · 13

    • 3.0.14-1+deb13u1 · arm64 · trixie

      Affected

      nvd · modsecurity · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]