CVE-2026-52747

Received Received - Intake

ModSecurity multipart/form-data parser line break handling flaw

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: GitHub, Inc.

Description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead of appending the current buffer. This creates a parser differential between ModSecurity and backend applications that preserve line breaks in form fields, allowing rules that inspect ARGS or ARGS_POST to miss payloads whose dangerous syntax depends on a line break. This issue is fixed in version 3.0.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-52747

Affected Vendors & Products

Vendor	Product	Version / Range
modsecurity	modsecurity	3.0.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-180	The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.

Attack-Flow Graph

Executive Summary

This vulnerability exists in ModSecurity versions prior to 3.0.16, specifically in the multipart/form-data request body parser. The parser silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST. This happens because the code overwrites reserved bytes instead of appending the current buffer, causing a difference in how ModSecurity and backend applications handle line breaks in form fields.

As a result, security rules that inspect ARGS or ARGS_POST may miss payloads that rely on line breaks for dangerous syntax, potentially allowing malicious input to bypass detection.

This issue was fixed in ModSecurity version 3.0.16.

Impact Analysis

The vulnerability can allow attackers to bypass security rules in ModSecurity that rely on inspecting form field values for malicious payloads. Because line breaks are removed silently, payloads that depend on line breaks to execute dangerous syntax may not be detected.

This can lead to increased risk of injection attacks or other exploits that the web application firewall is intended to block, potentially compromising the security of the web application.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade ModSecurity to version 3.0.16 or later, where the issue with the multipart/form-data request body parser has been fixed.

Hi! I’m here to help you understand CVE-2026-52747. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70