CVE-2026-44982

Name of the Vulnerable Software and Affected Versions crowdsec versions prior to 1.7.8

Description The AppSec component fails to read the HTTP request body when the Content-Length is not positive. This occurs specifically with HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests sent without a content-length header. The issue resides in the NewParsedRequestFromRequest() function within pkg/appsec/request.go. Because the request body is read as empty, any WAF rule targeting REQUEST BODY, BODY ARGS, ARGS POST, JSON, or XML fails to match. An unauthenticated remote attacker can bypass the body-inspection pipeline by modifying a framing header, allowing malicious requests to be forwarded without triggering WAF log entries. Header-only and URI-only rules remain unaffected.

Recommendations Update to a version newer than 1.7.7.