OWASP CRS Vulnerability Allows Attackers to Bypass Charset Validation

Cybersecuritynews •Abinaya • January 9, 2026

A critical vulnerability in the OWASP Core Rule Set (CRS) has been discovered that allows attackers to bypass important security protections designed to prevent charset-based attacks. The vulnerability, tracked as CVE-2026-21876, affects rule 922110 and carries a severity score of 9.3 (CRITICAL). OWASP CRS Vulnerability Rule 922110 is designed to block dangerous character encodings, such […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical OWASP CRS Vulnerability CVE-2026-21876 Discovered A critical vulnerability in the OWASP Core Rule Set (CRS), tracked as CVE-2026-21876, has been identified. This vulnerability allows attackers to bypass charset validation protections, affecting all supported versions of CRS and specifically targeting rule 922110, which is designed to block dangerous character encodings. The vulnerability has a CVSS score of 9.3, indicating its critical severity. 3 sources 30

Extracted Entities

CVEs (1)

CVE-2026-21876

Platforms (1)

Owasp Core Rule Set