# CVE-2026-52747: Security feature bypass in ModSecurity

> Attackers can bypass ModSecurity WAF rules by exploiting a parser differential that strips line breaks from form fields, hiding malicious payloads from inspection.

- **Severity:** High 8.6 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 10 Jul 2026
- **Updated:** 13 Jul 2026
- **Also known as:** AZL-92267, BIT-modsecurity-2026-52747, DEBIAN-CVE-2026-52747, GHSA-rcw9-2f5r-7p88, UBUNTU-CVE-2026-52747

## What is CVE-2026-52747?

CVE-2026-52747 is a high-severity vulnerability in owasp-modsecurity ModSecurity, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead of appending the current buffer. This creates a parser differential between ModSecurity and backend applications that preserve line breaks in form fields, allowing rules that inspect ARGS or ARGS_POST to miss payloads whose dangerous syntax depends on a line break. This issue is fixed in version 3.0.16.

Weakness: CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize)

## Which versions are affected by CVE-2026-52747?

1 open source package ship an affected version, including modsecurity. It affects 1 product.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `modsecurity` | Bitnami | All versions | 3.0.16 |

Products: Owasp Modsecurity.

## How do I fix CVE-2026-52747?

Upgrade modsecurity to 3.0.16 or later.

## Is CVE-2026-52747 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-52747 exists.

## Other vulnerabilities in owasp-modsecurity ModSecurity

- [CVE-2024-1019](https://insights.sbomify.com/CVE-2024-1019/): WAF bypass of the ModSecurity v3 release line (high 8.6)
- [CVE-2026-42268](https://insights.sbomify.com/CVE-2026-42268/): ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators (high 8.2)
- [CVE-2026-30923](https://insights.sbomify.com/CVE-2026-30923/): libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings (high 8.2)
- [CVE-2025-48866](https://insights.sbomify.com/CVE-2025-48866/): ModSecurity has possible DoS vulnerability in sanitiseArg action (high 7.5)
- [CVE-2023-38285](https://insights.sbomify.com/CVE-2023-38285/): Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity. (high 7.5)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-52747 and fix it if it is affected.

What it is: CVE-2026-52747 is a high-severity vulnerability in owasp-modsecurity ModSecurity, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-52747 exists.

Affected packages and fixed versions:
- modsecurity (Bitnami): affected all versions; fixed in 3.0.16

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-52747/ (Markdown: https://insights.sbomify.com/CVE-2026-52747/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-52747
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-52747
- OSV: https://osv.dev/vulnerability/CVE-2026-52747

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-52747/
Summaries are generated and may contain mistakes; the official description above is the record.