CVE-2026-52747

Name of the Vulnerable Software and Affected Versions ModSecurity versions prior to 3.0.16

Description The multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS POST. This occurs because the src/request body processor/multipart.cc file overwrites reserved bytes in m reserve instead of appending the current buffer. This behavior creates a parser differential between the WAF and backend applications that preserve line breaks, which can allow malicious payloads to bypass rules inspecting ARGS or ARGS POST if the dangerous syntax depends on a line break.

Recommendations Update to version 3.0.16.