CVE-2026-21876

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

The vulnerability is a logic bug in the OWASP Core Rule Set (CRS) affecting rule 922110 prior to versions 4.22.0 and 3.3.8. The rule processes multipart requests by iterating over collections such as MULTIPART_PART_HEADERS; because capture variables TX:0 and TX:1 are overwritten on each iteration, only the final captured value is passed to subsequent chained rules, allowing malicious charset values in earlier parts to be ignored when a later part contains a benign charset. The affected component is the generic attack-detection rule set used by compatible web application firewalls.

An unauthenticated remote attacker can craft a multipart request containing a malicious charset in one of the earlier parts followed by a legitimate charset in a subsequent part. Because the chained rule only evaluates the last captured value, the request evades detection and may result in high-impact consequences including confidentiality loss and limited integrity impact, as reflected in the CVSS 9.3 score.

The referenced GitHub advisory and release notes state that the issue is resolved in CRS 4.22.0 and 3.3.8; users should upgrade to one of these versions. The associated commits correct the capture-variable handling so that each multipart part is evaluated independently by the rule chain. The EPSS score remains low with only a modest peak of 0.0398 and no reported real-world exploitation.