The OWASP Core Rule Set (CRS) is an open-source Web Application Firewall (WAF) ruleset designed to detect and block web-based attacks when used with ModSecurity and compatible WAFs.
Overview
The OWASP Core Rule Set (CRS) is an open-source Web Application Firewall (WAF) ruleset designed to detect and block web-based attacks when used with ModSecurity and compatible WAFs. It provides a community-driven, broadly adopted collection of rules to enforce common security controls and protect against OWASP Top 10–style threats. The recent finding underscores that even widely used WAF rule sets can have input normalization weaknesses, highlighting the need for defense-in-depth and timely updates.
Related Threat Clusters
-
Critical OWASP CRS Vulnerability CVE-2026-21876 Discovered
A critical vulnerability in the OWASP Core Rule Set (CRS), tracked as CVE-2026-21876, has been identified. This vulnerability allows attackers to bypass charset validation protections, affecting all supported versions…
3 articles · Updated January 9, 2026
Recent Intelligence Reports
- OWASP CRS Vulnerability Allows Attackers to Bypass Charset Validation — Cybersecuritynews · January 9, 2026