CVE-2026-52747: OWASP ModSecurity XSS Vulnerability

CVE-2026-52747 Overview

CVE-2026-52747 is a parser differential vulnerability in ModSecurity, the open source web application firewall (WAF) engine for Apache, IIS, and Nginx. In versions prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to the ARGS and ARGS_POST collections. Backend applications that preserve line breaks receive the original payload, while WAF rules inspect a sanitized version. Attackers can smuggle payloads whose dangerous syntax depends on a line break past ModSecurity rules that would otherwise flag them. The issue is fixed in ModSecurity 3.0.16.

Critical Impact
WAF rules inspecting ARGS or ARGS_POST can be bypassed, allowing injection payloads to reach backend applications undetected.

Affected Products

OWASP ModSecurity versions prior to 3.0.16 (libmodsecurity v3 branch)
Deployments using ModSecurity on Apache, IIS, or Nginx that process multipart/form-data requests
Rule sets that rely on ARGS or ARGS_POST inspection, including OWASP Core Rule Set (CRS)

Discovery Timeline

2026-07-10 - CVE-2026-52747 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-52747

Vulnerability Analysis

The vulnerability is a parser differential [CWE-180: Incorrect Behavior Order] between libmodsecurity and downstream applications. When ModSecurity parses a multipart/form-data request body, it exports each non-file form-field value to the ARGS and ARGS_POST variables that WAF rules inspect. Because embedded CR/LF bytes are dropped during export, a payload such as a header-injection or template-injection string that requires a newline character to be dangerous appears benign to rules but reaches the application intact.

An attacker submits a form field whose malicious behavior depends on a literal line break. Signature and regex rules in the OWASP CRS and custom policies see a single-line, sanitized string and pass the request. The backend, which reconstructs the value with the newline preserved, then processes the injection payload.

Root Cause

The defect is in src/request_body_processor/multipart.cc. When flushing buffered content into the field value, the function overwrites reserved bytes stored in m_reserve rather than appending the current buffer. Bytes representing \r\n sequences that had been reserved are discarded rather than concatenated, producing a value that no longer contains the original line breaks.

Attack Vector

Exploitation is remote and unauthenticated over the network. An attacker sends a crafted multipart/form-data POST request containing a non-file field whose payload includes newline characters required for injection. ModSecurity strips the newlines before rule evaluation, allowing the request to bypass inspection while the backend receives the original bytes.

text

// Patch excerpt from src/request_body_processor/multipart.cc
 /*
  * ModSecurity, http://www.modsecurity.org/
  * Copyright (c) 2015 - 2021 Trustwave Holdings, Inc. (http://www.trustwave.com/)
- *
+ *               2024 - 2026 OWASP (https://owasp.org)
  * You may not use this file except in compliance with
  * the License.  You may obtain a copy of the License at
  *

Source: GitHub Commit 875504c. The fix changes how m_reserve bytes are handled so that buffered content, including line breaks, is appended to the field value instead of overwritten.

Detection Methods for CVE-2026-52747

Indicators of Compromise

multipart/form-data POST requests containing non-file form fields with embedded \r\n byte sequences inside quoted values.
Web application logs that record newline characters in parameter values while the corresponding ModSecurity audit log shows single-line values for the same request.
Requests that reach backend applications with injection syntax (SQL, template, header, or command) split across multiple lines despite active WAF rules.

Detection Strategies

Compare ModSecurity audit log entries for ARGS/ARGS_POST against backend application logs to identify divergence in field content length or newline count.
Deploy a secondary parser or reverse-proxy log that captures the raw request body and diff it against WAF-observed values to reveal stripped bytes.
Add custom ModSecurity rules that inspect REQUEST_BODY (raw) in addition to ARGS to catch multi-line payloads until the engine is upgraded.

Monitoring Recommendations

Track the installed libmodsecurity version across all Apache, IIS, and Nginx nodes and alert on any version below 3.0.16.
Monitor for spikes in multipart/form-data submissions with large non-file field values, particularly to endpoints handling templates, SQL, or headers.
Enable full request body logging on a sample of traffic to validate parser behavior after patching.

How to Mitigate CVE-2026-52747

Immediate Actions Required

Upgrade libmodsecurity to version 3.0.16 or later on every Apache, IIS, and Nginx node running ModSecurity v3.
Inventory reverse proxies, ingress controllers, and appliances that embed libmodsecurity and confirm vendor patch status.
Review OWASP CRS and custom rules for reliance on ARGS/ARGS_POST when inspecting fields that legitimately contain multi-line content.

Patch Information

The fix is included in ModSecurity Release v3.0.16 and delivered by commit 875504c2758169c41be1ad2f0cc64d896b7815d7. See the GitHub Security Advisory GHSA-rcw9-2f5r-7p88 for vendor guidance.

Workarounds

Add a rule that inspects REQUEST_BODY directly for dangerous multi-line patterns until the engine is upgraded.
Reject or normalize multipart/form-data requests containing embedded CR/LF bytes in non-file fields at an upstream proxy.
Restrict multipart/form-data submissions to endpoints that require file uploads and enforce content-type validation elsewhere.

bash

# Temporary ModSecurity rule to inspect raw body for CRLF-bearing payloads
SecRuleEngine On
SecRequestBodyAccess On
SecRule REQUEST_HEADERS:Content-Type "@contains multipart/form-data" \
  "id:1002747,phase:2,pass,nolog,ctl:forceRequestBodyVariable=On"
SecRule REQUEST_BODY "@rx (?i)(?:\r?\n)(?:select|union|<script|\{\{)" \
  "id:1002748,phase:2,deny,status:403,log,\
   msg:'Possible multipart CRLF-smuggled payload (CVE-2026-52747 workaround)'"