CVE-2026-21876: coreruleset
Vulnerability summary
CVE-2026-21876 is a critical (CVSS 9.3) vulnerability in coreruleset. EPSS estimates a 17.88% chance of exploitation in the next 30 days, higher than 97.1% of scored vulnerabilities. 3 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 08-01-2026PublishedVulnerability first disclosed.
- 09-04-2026Last modifiedVulnerability information updated.
Description
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
17.88%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
+0.38 pp
From 17.51% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundCve 2026 21876
Maturity: poc
Coreruleset
Maturity: poc
coreruleset 4.21.0 - Firewall Bypass
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Coreruleset1 product
- coreruleset< 4.22.0 | < 3.3.8
Debian1 product
- modsecurity-crs< 3.3.8-1 | < 3.3.4-1+deb12u1 | < 3.3.7-1+deb13u1
Owasp1 product
- owasp_modsecurity_core_rule_set< 3.3.8 | ≥ 4.0.0, < 4.22.0
Ubuntu1 product
- modsecurity-crsAll versions (No fix recorded)
4 vendors · 4 products
References
9 links- github.com/coreruleset/coreruleset/security/advisories/GHSA-36fv-25j3-r2c5X Refsource CONFIRMREPORTExploitVendor Advisory
- github.com/coreruleset/coreruleset/commit/80d80473abf71bd49bf6d3c1ab221e3c74e4eb83X Refsource MISCREPORTPatch
- github.com/coreruleset/coreruleset/commit/9917985de09a6cf38b3261faf9105e909d67a7d6X Refsource MISCREPORTPatch
