Critical · published January 8, 2026
🔥 A simple multipart request can slip malicious content past your defenses! A bug in OWASP's core rule set allows a crafty attacker to bypass detection due to variable overwriting. ⚡ Think of this as a restaurant kitchen where a chef keeps replacing the previous order with the latest one on the list—if the last dish looks perfect, they might not notice the sneaky ingredient snuck in earlier! This oversight means an attacker could successfully deliver harmful payloads that could exploit your application without triggering any alarms. Imagine the chaos if your web application doesn't catch malicious charsets hidden within legitimate multipart requests!
Think of this as a restaurant kitchen where a chef keeps replacing the previous order with the latest one on the list—if the last dish looks perfect, they might not notice the sneaky ingredient snuck in earlier! Prior to versions 4.22.0 and 3.3.8, a bug in rule 922110 causes capture variables to be overwritten with each iteration of multipart request parts, resulting in only the last valid charset being recognized instead of all parts being checked correctly.
This oversight means an attacker could successfully deliver harmful payloads that could exploit your application without triggering any alarms. Imagine the chaos if your web application doesn't catch malicious charsets hidden within legitimate multipart requests! Update your OWASP core rule set to version 4.22.0 or 3.3.8 immediately to ensure all multipart request parts are scanned properly. Also, review your existing configurations to mitigate any potential risks from this bug. You've got this! Stay vigilant and patch up—your web application will thank you! 🛡️