OWASP CRS Vulnerability Allows Attackers to Bypass Charset Validation

Cyberpress • January 9, 2026

The vulnerability , tracked as CVE-2026-21876 with a CVSS score of 9.3 (CRITICAL), affects all supported versions of CRS and has been present since ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical OWASP CRS Vulnerability CVE-2026-21876 Discovered A critical vulnerability in the OWASP Core Rule Set (CRS), tracked as CVE-2026-21876, has been identified. This vulnerability allows attackers to bypass charset validation protections, affecting all supported versions of CRS and specifically targeting rule 922110, which is designed to block dangerous character encodings. The vulnerability has a CVSS score of 9.3, indicating its critical severity. 3 sources 30

Extracted Entities

CVEs (1)

CVE-2026-21876