CVE-2026-21876: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-21876 is a WAF bypass vulnerability in the OWASP ModSecurity Core Rule Set (CRS) caused by a logic flaw in rule 922110 when processing multipart HTTP requests with multiple parts. Disclosed on January 6–8, 2026, it affects all CRS 4.x versions prior to 4.22.0 and all CRS 3.x versions prior to 3.3.8. The vulnerability was reported responsibly by researcher daytriftnewgen and patched in CRS 4.22.0 and 3.3.8 released on January 5–6, 2026. The CVSS v3.1 base score is 5.3 (Medium) per NVD, though the GitHub Security Advisory rates it 9.3 (Critical) under a changed-scope vector (GitHub Advisory, CRS Release v3.3.8, CRS Release v4.22.0).

The root cause is classified as CWE-794 (Incomplete Filtering of Multiple Instances of Special Elements). Rule 922110 in REQUEST-922-MULTIPART-ATTACK.conf previously used a chained rule pattern where the first rule iterated over the MULTIPART_PART_HEADERS collection using a regex capture, storing results in TX:0/TX:1. Because these capture variables are overwritten on each iteration, only the last part's Content-Type charset value was available to the chained rule for validation. An attacker could craft a multipart request where an early part contains a malicious charset (e.g., charset=utf-7) and a later part contains a legitimate charset (e.g., charset=utf-8); the chained rule would only evaluate the final, benign value and pass the request. The fix introduces two new intermediate rules (922140 and 922150) that collect all Content-Type values into indexed TX variables (tx.multipart_headers_content_types_N), which are then evaluated collectively by the updated rule 922110 against the full set (GitHub Advisory, Patch Commit 4.x, Patch Commit 3.x).

Successful exploitation allows an unauthenticated, remote attacker to bypass WAF charset-based injection protections enforced by OWASP CRS rule 922110, enabling delivery of malicious payloads (e.g., UTF-7 encoded injection attacks) that would otherwise be blocked. The primary impact is an integrity bypass — the WAF fails to detect and block attacks targeting downstream web applications, potentially enabling cross-site scripting (XSS), SQL injection, or other charset-dependent injection attacks against the protected application. Confidentiality impact is rated high in the GitHub advisory's scope-changed scoring, reflecting the potential for sensitive data exposure if downstream applications are successfully attacked (GitHub Advisory, CRS Blog).

No confirmed in-the-wild exploitation has been reported, and no weaponized exploit kit usage has been observed. A GitHub repository (daytriftnewgen/CVE-2026-21876) and references to Exploit-DB entry EDB-ID:52558 and Sploitus listings indicate public proof-of-concept code exists. The EPSS score is approximately 0.032% (0.000320), reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Progress Software (which bundles CRS in its WAF products) issued a security advisory in April 2026 addressing this issue (GitHub Advisory, Help Net Security, Cybernoz).

1. Reconnaissance: Identify web applications protected by OWASP CRS-enabled WAFs (ModSecurity, Coraza, or commercial WAFs like Progress MOVEit WAF) running CRS versions prior to 4.22.0 or 3.3.8. Version fingerprinting may be possible via error responses or WAF-specific headers.
2. Craft malicious multipart request: Construct an HTTP POST request with Content-Type: multipart/form-data containing at least two parts. Place the malicious charset in the first part's Content-Type header (e.g., Content-Type: text/plain; charset=utf-7) and a legitimate charset in a subsequent part (e.g., Content-Type: text/plain; charset=utf-8).
3. Exploit capture variable overwrite: Because rule 922110 only evaluates the last captured TX:1 value from the MULTIPART_PART_HEADERS iteration, the chained rule sees only the legitimate utf-8 charset from the final part and allows the request through.
4. Deliver payload: Embed the actual attack payload (e.g., a UTF-7 encoded XSS string like +ADw-script+AD4-alert(1)+ADw-/script+AD4-) in the first multipart part's body, which the WAF fails to inspect due to the charset bypass.
5. Achieve objective: The malicious payload reaches the backend application unfiltered, potentially enabling XSS, injection, or other charset-dependent attacks against the unprotected application (GitHub Advisory, CRS Blog).

• Network: HTTP POST requests to web application endpoints with multipart/form-data content containing multiple parts where earlier parts declare non-standard charsets (e.g., utf-7, utf-16, iso-2022) and later parts declare standard charsets (utf-8, iso-8859-1, windows-1252).
• Network: Requests where multipart body parts contain encoded attack strings (e.g., UTF-7 encoded +ADw-, +AFs-, +ACA- sequences) that bypass WAF inspection.
• Logs: WAF/ModSecurity audit logs showing rule 922110 not triggering on multipart requests with multiple Content-Type headers containing mixed charsets (absence of expected block events).
• Logs: Web server access logs showing successful responses (HTTP 200) to multipart form submissions that contain non-standard charset declarations in early parts.
• Logs: Application-level logs showing unexpected character encoding in form field values, particularly UTF-7 or other non-standard encodings in user-supplied input fields.

Upgrade OWASP CRS to version 4.22.0 (for 4.x branch) or 3.3.8 (for 3.x branch), both released January 5–6, 2026, which fix rule 922110 by introducing intermediate rules 922140 and 922150 to properly collect and evaluate all multipart Content-Type values (CRS Release v4.22.0, CRS Release v3.3.8). Debian LTS packages were updated in February 2026 (DLA-4488-1) for distributions shipping older CRS versions. As an interim workaround for organizations unable to patch immediately, implement additional application-level input validation to reject multipart requests containing non-allowlisted charset declarations across any part, and consider blocking or alerting on requests with non-standard charsets (utf-7, utf-16, iso-2022) at the network perimeter (GitHub Advisory).

The CRS project blog published a detailed advisory on January 6, 2026, crediting researcher daytriftnewgen for responsible disclosure (CRS Blog). The vulnerability received significant community attention on Reddit (r/netsec, r/cybersecurity) and Mastodon/Infosec.exchange, with discussions highlighting the discrepancy between NVD's 5.3 Medium score and GitHub's 9.3 Critical rating. Help Net Security and multiple security news outlets (CyberSecurityNews, GBHackers, eSecurity Planet) covered the vulnerability in January 2026, and renewed coverage emerged in April 2026 when Progress Software patched its WAF product. The Hacker News included it in their weekly recap for the week of January 12, 2026. Check Point Research published a detection advisory (CPAI-2026-3679) in May 2026 (Help Net Security).