CVE-2022-39955

CVE-2022-39955 describes a critical partial rule set bypass vulnerability in the OWASP ModSecurity Core Rule Set (CRS) affecting versions 3.0.x, 3.1.x, 3.2.1, and 3.3.2. Attackers can exploit this by crafting HTTP Content-Type headers with multiple character encoding schemes, allowing encoded malicious payloads to bypass CRS detection and potentially be decoded by vulnerable backends. With a CVSS score of 9.8 (Critical), this network-exploitable vulnerability requires no user interaction or privileges and can lead to high impacts on confidentiality, integrity, and availability. While no public exploits (Metasploit, Nuclei, ExploitDB) or active exploitation have been identified, and community discussion is minimal, immediate upgrades to CRS 3.2.2 or 3.3.3 are strongly advised.