CVE detail
CVE-2026-21876
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 24.0 · diversity 16.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
10 source links · newest first
- Week in review: Claude Mythos finds 271 Firefox flaws, Vercel breachHelp Net Security
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: SmokedMeat: Open-source tool shows what attackers do inside CI/CD pipelines Boost Security has released SmokedMeat, an open-source framework that runs attack chains against CI/CD infrastructure so engineering and security teams can see what an attacker would do in their specific environment. NGate NFC malware targets Android users through trojanized payment app NFC-based payment fraud is expanding geographically and operationally. A … More →
newswww.helpnetsecurity.comApr 26, 2026, 8:00 AM Progress Software has fixed a slew of high-severity vulnerabilities in MOVEit WAF and LoadMaster, including a flaw (CVE-2026-21876) that may allow attackers to bypass firewall detection. MOVEit WAF (web application firewall) is designed to protect Progress’s managed file transfer platform MOVEit Transfer from web-based attacks. (A zero-day vulnerability in MOVEit Transfer was infamously exploited in 2023 by the Cl0p cyber extortion gang to grab data from hundreds of organizations.) LoadMaster is the company’s general-purpose enterprise … More →
newswww.helpnetsecurity.comApr 22, 2026, 11:29 AMThe security defects could be exploited for remote code execution, OS command injection, and WAF detection bypass.
newswww.securityweek.comApr 21, 2026, 12:14 PMLinked URL: https://coreruleset.org/20260106/cve-2026-21876-critical-multipart-charset-bypass-fixed-in-crs-4.22.0-and-3.3.8/ | Posted by el_duderino | 2 points | 0 comments
communitynews.ycombinator.comJan 8, 2026, 8:35 PMNo excerpt available.
Exploitgithub.comJan 8, 2026, 2:15 PMNo excerpt available.
Exploitgithub.comJan 8, 2026, 2:15 PMNo excerpt available.
Exploitgithub.comJan 8, 2026, 2:15 PMNo excerpt available.
Exploitgithub.comJan 8, 2026, 2:15 PM- https://github.com/coreruleset/coreruleset/commit/9917985de09a6cf38b3261faf9105e909d67a7d6github.com
No excerpt available.
Exploitgithub.comJan 8, 2026, 2:15 PM - https://github.com/coreruleset/coreruleset/commit/80d80473abf71bd49bf6d3c1ab221e3c74e4eb83github.com
No excerpt available.
Exploitgithub.comJan 8, 2026, 2:15 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2021-0233CVSS 7.5 · High
A vulnerability in Juniper Networks Junos OS ACX500 Series, ACX4000 Series, may allow an attacker to cause a Denial of Service (DoS) by sending a high rate of specific packets to…
- CVE-2021-0203CVSS 8.6 · High
On Juniper Networks EX and QFX5K Series platforms configured with Redundant Trunk Group (RTG), Storm Control profile applied on the RTG interface might not take affect when it rea…
- CVE-2020-1665CVSS 5.3 · Medium
On Juniper Networks MX Series and EX9200 Series, in a certain condition the IPv6 Distributed Denial of Service (DDoS) protection might not take affect when it reaches the threshol…
- CVE-2019-0002CVSS 9.8 · Critical
On EX2300 and EX3400 series, stateless firewall filter configuration that uses the action 'policer' in combination with other actions might not take effect. When this issue occurs…
- CVE-2026-33691CVSS 6.8 · Medium
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identi…
- CVE-2022-39958CVSS 7.5 · High
The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP…