CVE-2026-33691: coreruleset Improper Handling of Case Sensitivity
Vulnerability summary
CVE-2026-33691 is a high (CVSS 7.5) Improper Handling of Case Sensitivity vulnerability in coreruleset. EPSS estimates a 1.58% chance of exploitation in the next 30 days, higher than 75.1% of scored vulnerabilities.
Timeline
- 02-04-2026PublishedVulnerability first disclosed.
- 18-04-2026Last modifiedVulnerability information updated.
Description
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
1.58%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
-2.00 pp
From 3.58% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Coreruleset1 product
- coreruleset< 3.3.9 | ≥ 4.0.0-rc1, < 4.25.0
Debian1 product
- modsecurity-crs< 3.3.4-1+deb12u3 | < 3.3.7-1+deb13u2 | < 3.3.9-1
Opensuse1 product
- owasp-modsecurity-crs&distro=openSUSE Tumbleweed< 4.29.0-1.1
Owasp1 product
- owasp_modsecurity_core_rule_set< 3.3.9 | ≥ 4.0.0, < 4.25.0
Ubuntu1 product
- modsecurity-crsAll versions (No fix recorded)
5 vendors · 5 products
References
14 links- github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2wX Refsource CONFIRMREPORTMitigationPatchVendor Advisory
- github.com/coreruleset/coreruleset/commit/2a8c63512811c5dd74472becebb79a783e68ff02X Refsource MISCPatch
