CVE-2026-52747 Security feature bypass in ModSecurity
Attackers can bypass ModSecurity WAF rules by exploiting a parser differential that strips line breaks from form fields, hiding malicious payloads from inspection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52747?
CVE-2026-52747 is a high-severity vulnerability in owasp-modsecurity ModSecurity, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead of appending the current buffer. This creates a parser differential between ModSecurity and backend applications that preserve line breaks in form fields, allowing rules that inspect ARGS or ARGS_POST to miss payloads whose dangerous syntax depends on a line break. This issue is fixed in version 3.0.16.
Weakness: CWE-180
Which versions are affected by CVE-2026-52747?
1 open source package ship an affected version, including modsecurity. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
modsecurity Bitnami | All versions | 3.0.16 |
Products include Owasp Modsecurity.
How do I fix CVE-2026-52747?
Upgrade modsecurity to 3.0.16 or later.
Is CVE-2026-52747 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-52747 exists.
Other vulnerabilities in owasp-modsecurity ModSecurity
- CVE-2024-1019 WAF bypass of the ModSecurity v3 release line
- CVE-2026-42268 ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators
- CVE-2026-30923 libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings
- CVE-2025-48866 ModSecurity has possible DoS vulnerability in sanitiseArg action
- CVE-2023-38285 Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity.
Sources
Also known as AZL-92267, BIT-modsecurity-2026-52747, DEBIAN-CVE-2026-52747, GHSA-rcw9-2f5r-7p88, UBUNTU-CVE-2026-52747.