Preliminary research

CVE-2026-21876: bypassing OWASP CRS by overwriting the multipart charset in a later segment

CVE-2026-21876: Multipart Charset Validation Bypass in OWASP CRS

daytriftnewgen (some0ne) · Habr · 12 January 2026

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Shows an OWASP CRS multipart rule overwriting one capture variable while iterating header values. A harmless charset in a later part hides an earlier dangerous value from final validation; the research and fix discussion illustrate why captures must be retained and checked per occurrence, including duplicate part names.

Record

Document

CVE-2026-21876: Multipart Charset Validation Bypass in OWASP CRS

Researcher

daytriftnewgen (some0ne)

Published by

Habr

Date

12 January 2026

Topic

Other

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• CVE-2026-21876 proof of concept and lab
• OWASP CRS CVE-2026-21876 advisory Advisory

Tags

• waf-bypass
• charset
• parser-differential
• filter-bypass
• owasp-a02-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of daytriftnewgen (some0ne), first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 13 September 2026.