coreruleset vulnerabilities

Products

• coreruleset 2

Latest coreruleset CVEs

Newest publication first

1. CVE-2026-33691 OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks

   Published 2026-04-02

   Medium·CVSS 6.8

   The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by...

2. CVE-2026-21876 OWASP CRS has multipart bypass using multiple content-type parts

   Published 2026-01-08

   Critical·CVSS 9.3 EPSS 17.3%

   The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.