Medium [CVE-2026-52747] Security rule bypass due to incorrect handling of line breaks in form data

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead of appending the current buffer.

This creates a parser differential between ModSecurity and backend applications that preserve line breaks in form fields, allowing rules that inspect ARGS or ARGS_POST to miss payloads whose dangerous syntax depends on a line break. This issue is fixed in version 3.0.16.

This bypass could lead to the execution of dangerous payloads that rely on line breaks, potentially resulting in a security compromise.

This issue is classified as Moderate severity primarily because: Conditions for Exploitation: Successful exploitation requires a specific scenario where the backend application preserves line breaks and is inherently vulnerable to a payload that utilizes those line breaks.

Additionally, the ModSecurity configuration must rely on rules inspecting the affected ARGS or ARGS_POST variables to allow the bypass to occur.