ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGSPOST because src/requestbodyprocessor/multipart.cc overwrites reserved bytes in mreserve instead of appending the current buffer. This creates a parser differential between ModSecurity and backend applications that preserve line breaks in form fields, allowing rules that inspect ARGS or ARGSPOST to miss payloads whose dangerous syntax depends on a line break. This issue is fixed in version 3.0.16.

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8tounicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 architecture. This issue is fixed in version 3.0.16.

Hi,

On Sat, Apr 18, 2026 at 08:14:12AM -0400, cyber security wrote: Also you can use CVE-2026-33691, to disable security headers while bypassing CRS

More info at https://unlockoldupload.hashnode.dev/turn-off-security-headers-using-cve-2026-33691 This gives a 404 Page Not Found, but more importantly actual content should have been directly included in your posting, not only referenced via a link (although providing a link as well would then be OK). On Sat, Apr 18, 2026 at 3:00 AM cyber security <cs7778503 () gmail com> wrote: After deep analysis we confirm, that CVE-2026-33691 aka it alias UnlockOldUpload, can even disable ModSecurity WAF

More info at https://unlockoldupload.hashnode.dev/disable-modsecurity-waf-using-cve-2026-33691. This one exists. The gist of it is:

"upload a file called .htaccess with the content SecRuleEngine Off"

which should have been directly in your message.

With this, I think you've said enough about this CVE already, and should stop here - no further examples are needed.

Thanks,

Alexander

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is application/json, and there is at least one rule which does a sanitiseMatchedBytes action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.

A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name parameter. NOTE: this is disputed by the Supplier because it cannot be reproduced. Also, the product's documentation indicates that it is not guaranteed to be usable with very large values of SecRequestBodyNoFilesLimit (which are required by the claimed issue).

ModSecurity v3.0.x is affected by a Denial of Service vulnerability due to the global matching of regular expressions. The combination of a non-anchored regular expression and the ModSecurity “capture” action can be exploited via a specially crafted payload.

Known Affected Software Configurations:

ModSecurity v3.0.0 ModSecurity v3.0.1 ModSecurity v3.0.2 ModSecurity v3.0.3 ModSecurity v3.0.4 (patch for this version available