{"id":"CVE-2026-52747","summary":"ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass","details":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead of appending the current buffer. This creates a parser differential between ModSecurity and backend applications that preserve line breaks in form fields, allowing rules that inspect ARGS or ARGS_POST to miss payloads whose dangerous syntax depends on a line break. This issue is fixed in version 3.0.16.","aliases":["BIT-modsecurity-2026-52747","GHSA-rcw9-2f5r-7p88"],"modified":"2026-08-12T16:25:43.169595Z","published":"2026-07-10T21:42:11.503Z","database_specific":{"cwe_ids":["CWE-180"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52747.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.16"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52747.json"},{"type":"ADVISORY","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-rcw9-2f5r-7p88"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52747"},{"type":"FIX","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/875504c2758169c41be1ad2f0cc64d896b7815d7"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/owasp-modsecurity/modsecurity","events":[{"introduced":"0"},{"fixed":"7ea9fefbe0ba409d8733b4d682c8c4c059cd028d"},{"fixed":"875504c2758169c41be1ad2f0cc64d896b7815d7"}],"database_specific":{"cpe":"cpe:2.3:a:owasp:modsecurity:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.0.16"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v4.0.0.0","v3.0.15","v3.0.14","v3.0.13","v3.0.12","v3.0.11","v3.0.10","v3.0.9","v3.0.8","v3.0.7","v3.0.6","v3.0.5","v3.0.4","v3.0.3","v3.0.2","v3.0.1","v3.0.0","v3.0.0-rc1","v2.9.0","v2.9.0-rc2","v2.9.0-rc1","v2.7.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52747.json","vanir_signatures_modified":"2026-08-12T16:25:43Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/owasp-modsecurity/modsecurity/commit/875504c2758169c41be1ad2f0cc64d896b7815d7","target":{"file":"src/request_body_processor/multipart.cc"},"deprecated":false,"digest":{"line_hashes":["172847367914163763902577858060215230369","119965025624261581467155950682354886311","86117948540492774593304806802312181345","178709695677534367470416503912221656507","250512267671779956602397810641455197126"],"threshold":0.9},"id":"CVE-2026-52747-1d33b0e4"},{"digest":{"length":5163,"function_hash":"94198314872370756934385654425389990914"},"id":"CVE-2026-52747-354231a5","signature_type":"Function","signature_version":"v1","source":"https://github.com/owasp-modsecurity/modsecurity/commit/875504c2758169c41be1ad2f0cc64d896b7815d7","target":{"file":"src/request_body_processor/multipart.cc","function":"Multipart::process_part_data"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"}]}