CVE-2022-39956

CVE-2022-39956 describes a critical partial rule set bypass vulnerability in the OWASP ModSecurity Core Rule Set (CRS) versions 3.0.x, 3.1.x, 3.2.1, and 3.3.2. This flaw allows attackers to bypass the web application firewall by submitting HTTP multipart requests using specific character encoding schemes in Content-Type or Content-Transfer-Encoding headers, which are not properly decoded and inspected. With a CVSS score of 9.8 (CRITICAL), this vulnerability has a low attack complexity and can lead to full compromise (confidentiality, integrity, and availability) if a vulnerable backend supports these encoding schemes. There is currently no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in CISA's KEV catalog.