Vulnerability-Lookup

CVE-2026-33691 (GCVE-0-2026-33691)

Vulnerability from cvelistv5 – Published: 2026-04-02 15:03 – Updated: 2026-04-18 19:16

Title

OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks

Summary

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-178 - Improper Handling of Case Sensitivity

Assigner

GitHub_M

References

10 references

URL	Tags
https://github.com/coreruleset/coreruleset/securi…	x_refsource_CONFIRM
https://github.com/coreruleset/coreruleset/pull/4546	x_refsource_MISC
https://github.com/coreruleset/coreruleset/pull/4547	x_refsource_MISC
https://github.com/coreruleset/coreruleset/pull/4548	x_refsource_MISC
https://github.com/coreruleset/coreruleset/commit…	x_refsource_MISC
https://github.com/coreruleset/coreruleset/releas…	x_refsource_MISC
https://github.com/coreruleset/coreruleset/releas…	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2026/03/29/2
http://seclists.org/fulldisclosure/2026/Apr/0
http://www.openwall.com/lists/oss-security/2026/04/18/4

Impacted products

1 product

Vendor	Product	Version
coreruleset	coreruleset	Affected: < 3.3.9 Affected: >= 4.0.0-rc1, < 4.25.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-04-18T19:16:54.006Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/29/2"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2026/Apr/0"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/04/18/4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33691",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-02T17:38:01.007742Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-02T17:38:10.247Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "coreruleset",
          "vendor": "coreruleset",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.3.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0-rc1, \u003c 4.25.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-178",
              "description": "CWE-178: Improper Handling of Case Sensitivity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T15:03:52.126Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w"
        },
        {
          "name": "https://github.com/coreruleset/coreruleset/pull/4546",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/coreruleset/coreruleset/pull/4546"
        },
        {
          "name": "https://github.com/coreruleset/coreruleset/pull/4547",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/coreruleset/coreruleset/pull/4547"
        },
        {
          "name": "https://github.com/coreruleset/coreruleset/pull/4548",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/coreruleset/coreruleset/pull/4548"
        },
        {
          "name": "https://github.com/coreruleset/coreruleset/commit/2a8c63512811c5dd74472becebb79a783e68ff02",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/coreruleset/coreruleset/commit/2a8c63512811c5dd74472becebb79a783e68ff02"
        },
        {
          "name": "https://github.com/coreruleset/coreruleset/releases/tag/v3.3.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/coreruleset/coreruleset/releases/tag/v3.3.9"
        },
        {
          "name": "https://github.com/coreruleset/coreruleset/releases/tag/v4.25.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/coreruleset/coreruleset/releases/tag/v4.25.0"
        }
      ],
      "source": {
        "advisory": "GHSA-rw5f-9w43-gv2w",
        "discovery": "UNKNOWN"
      },
      "title": "OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33691",
    "datePublished": "2026-04-02T15:03:52.126Z",
    "dateReserved": "2026-03-23T16:34:59.932Z",
    "dateUpdated": "2026-04-18T19:16:54.006Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-33691",
      "date": "2026-07-24",
      "epss": "0.03579",
      "percentile": "0.88168"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-33691\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-04-02T16:16:22.593\",\"lastModified\":\"2026-07-24T21:10:00.143\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0.\"},{\"lang\":\"es\",\"value\":\"El conjunto de reglas base de OWASP (CRS) es un conjunto de reglas gen\u00e9ricas de detecci\u00f3n de ataques para usar con firewalls de aplicaciones web compatibles. Antes de las versiones 3.3.9 y 4.25.0, se identific\u00f3 un bypass en OWASP CRS que permite la carga de archivos con extensiones peligrosas (.PHP, .phar, .jsp, .jspx) insertando relleno de espacios en blanco en el nombre del archivo (por ejemplo, photo. PHP o shell.jsp ). Las reglas afectadas no normalizan los espacios en blanco antes de evaluar la expresi\u00f3n regular de la extensi\u00f3n de archivo, por lo que la comprobaci\u00f3n de extensi\u00f3n de punto falla al coincidir. Este problema ha sido parcheado en las versiones 3.3.9 y 4.25.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"coreruleset\",\"product\":\"coreruleset\",\"versions\":[{\"version\":\"\u003c 3.3.9\",\"status\":\"affected\"},{\"version\":\"\u003e= 4.0.0-rc1, \u003c 4.25.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N\",\"baseScore\":6.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":4.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-02T17:38:01.007742Z\",\"id\":\"CVE-2026-33691\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-178\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.3.9\",\"matchCriteriaId\":\"33F8A888-1ED5-40BC-B1B9-7AA88411B0E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0.0\",\"versionEndExcluding\":\"4.25.0\",\"matchCriteriaId\":\"8822CE75-E018-4576-B30B-A25A1A2F60E0\"}]}]}],\"references\":[{\"url\":\"https://github.com/coreruleset/coreruleset/commit/2a8c63512811c5dd74472becebb79a783e68ff02\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/coreruleset/coreruleset/pull/4546\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://github.com/coreruleset/coreruleset/pull/4547\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://github.com/coreruleset/coreruleset/pull/4548\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/coreruleset/coreruleset/releases/tag/v3.3.9\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\",\"Release Notes\"]},{\"url\":\"https://github.com/coreruleset/coreruleset/releases/tag/v4.25.0\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\",\"Release Notes\"]},{\"url\":\"https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2026/Apr/0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/03/29/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/04/18/4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-28T07:30:21+00:00",
      "cve": "CVE-2026-33691",
      "id": "CVE-2026-33691",
      "initial_release_date": "2026-04-02T15:03:52.126000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "coreruleset: OWASP Core Rule Set: File upload bypass via whitespace padding in filenames",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33691.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/03/29/2\"}, {\"url\": \"http://seclists.org/fulldisclosure/2026/Apr/0\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2026/04/18/4\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-04-18T19:16:54.006Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-33691\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-02T17:38:01.007742Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-02T17:38:04.990Z\"}}], \"cna\": {\"title\": \"OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks\", \"source\": {\"advisory\": \"GHSA-rw5f-9w43-gv2w\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"coreruleset\", \"product\": \"coreruleset\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3.3.9\"}, {\"status\": \"affected\", \"version\": \"\u003e= 4.0.0-rc1, \u003c 4.25.0\"}]}], \"references\": [{\"url\": \"https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w\", \"name\": \"https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/coreruleset/coreruleset/pull/4546\", \"name\": \"https://github.com/coreruleset/coreruleset/pull/4546\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/coreruleset/coreruleset/pull/4547\", \"name\": \"https://github.com/coreruleset/coreruleset/pull/4547\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/coreruleset/coreruleset/pull/4548\", \"name\": \"https://github.com/coreruleset/coreruleset/pull/4548\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/coreruleset/coreruleset/commit/2a8c63512811c5dd74472becebb79a783e68ff02\", \"name\": \"https://github.com/coreruleset/coreruleset/commit/2a8c63512811c5dd74472becebb79a783e68ff02\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/coreruleset/coreruleset/releases/tag/v3.3.9\", \"name\": \"https://github.com/coreruleset/coreruleset/releases/tag/v3.3.9\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/coreruleset/coreruleset/releases/tag/v4.25.0\", \"name\": \"https://github.com/coreruleset/coreruleset/releases/tag/v4.25.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-178\", \"description\": \"CWE-178: Improper Handling of Case Sensitivity\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-04-02T15:03:52.126Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-33691\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-18T19:16:54.006Z\", \"dateReserved\": \"2026-03-23T16:34:59.932Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-04-02T15:03:52.126Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0883

Vulnerability from certfr_avis - Published: 2026-07-15 - Updated: 2026-07-15

De multiples vulnérabilités ont été découvertes dans Progress LoadMaster. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Progress	LoadMaster	LoadMaster GA versions antérieures à v7.2.63.2
Progress	N/A	ECS Connection Manager versions antérieures à v7.2.63.2
Progress	N/A	Connection Manager for ObjectScale versions antérieures à v7.2.63.2
Progress	LoadMaster	LoadMaster LTFS versions antérieures à v7.2.54.18

References

Title

Publication Time

FKIE_CVE-2026-33691

Vulnerability from fkie_nvd - Published: 2026-04-02 16:16 - Updated: 2026-06-17 10:37

Severity

6.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/coreruleset/coreruleset/commit/2a8c63512811c5dd74472becebb79a783e68ff02	Patch
security-advisories@github.com	https://github.com/coreruleset/coreruleset/pull/4546	Issue Tracking, Patch
security-advisories@github.com	https://github.com/coreruleset/coreruleset/pull/4547	Issue Tracking, Patch
security-advisories@github.com	https://github.com/coreruleset/coreruleset/pull/4548	Patch
security-advisories@github.com	https://github.com/coreruleset/coreruleset/releases/tag/v3.3.9	Product, Release Notes
security-advisories@github.com	https://github.com/coreruleset/coreruleset/releases/tag/v4.25.0	Product, Release Notes
security-advisories@github.com	https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w	Mitigation, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://seclists.org/fulldisclosure/2026/Apr/0	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2026/03/29/2	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2026/04/18/4

Impacted products

	Vendor	Product	Version
	owasp	owasp_modsecurity_core_rule_set	*
	owasp	owasp_modsecurity_core_rule_set	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "coreruleset",
          "vendor": "coreruleset",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.3.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0-rc1, \u003c 4.25.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "33F8A888-1ED5-40BC-B1B9-7AA88411B0E0",
              "versionEndExcluding": "3.3.9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8822CE75-E018-4576-B30B-A25A1A2F60E0",
              "versionEndExcluding": "4.25.0",
              "versionStartIncluding": "4.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0."
    }
  ],
  "id": "CVE-2026-33691",
  "lastModified": "2026-06-17T10:37:56.047",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33691",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-02T17:38:01.007742Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-02T16:16:22.593",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/coreruleset/coreruleset/commit/2a8c63512811c5dd74472becebb79a783e68ff02"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/coreruleset/coreruleset/pull/4546"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/coreruleset/coreruleset/pull/4547"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/coreruleset/coreruleset/pull/4548"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/coreruleset/coreruleset/releases/tag/v3.3.9"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/coreruleset/coreruleset/releases/tag/v4.25.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://seclists.org/fulldisclosure/2026/Apr/0"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2026/03/29/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2026/04/18/4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-178"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

ubuntu-cve-2026-33691

Vulnerability from osv_ubuntu

Published

2026-04-02 16:16

Modified

2026-05-20 15:27

Summary

Details

Severity

6.8 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-33691	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-33691	REPORT
	https://github.com/coreruleset/coreruleset/securi…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "modsecurity-crs",
            "binary_version": "2.2.9-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "modsecurity-crs",
        "purl": "pkg:deb/ubuntu/modsecurity-crs@2.2.9-1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.2.9-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "modsecurity-crs",
            "binary_version": "3.0.2-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "modsecurity-crs",
        "purl": "pkg:deb/ubuntu/modsecurity-crs@3.0.2-1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.0.0-3",
        "3.0.2-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "modsecurity-crs",
            "binary_version": "3.2.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "modsecurity-crs",
        "purl": "pkg:deb/ubuntu/modsecurity-crs@3.2.0-1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.1-1",
        "3.2.0-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "modsecurity-crs",
            "binary_version": "3.3.2-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "modsecurity-crs",
        "purl": "pkg:deb/ubuntu/modsecurity-crs@3.3.2-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.3.0-1",
        "3.3.2-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "modsecurity-crs",
            "binary_version": "3.3.5-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "modsecurity-crs",
        "purl": "pkg:deb/ubuntu/modsecurity-crs@3.3.5-2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.3.5-1",
        "3.3.5-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "modsecurity-crs",
            "binary_version": "3.3.7-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "modsecurity-crs",
        "purl": "pkg:deb/ubuntu/modsecurity-crs@3.3.7-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.3.7-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "modsecurity-crs",
            "binary_version": "3.3.8-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "modsecurity-crs",
        "purl": "pkg:deb/ubuntu/modsecurity-crs@3.3.8-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.3.7-1",
        "3.3.8-1"
      ]
    }
  ],
  "aliases": [],
  "details": "The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0.",
  "id": "UBUNTU-CVE-2026-33691",
  "modified": "2026-05-20T15:27:22Z",
  "published": "2026-04-02T16:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-33691"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33691"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-33691"
  ]
}

WID-SEC-W-2026-1812

Vulnerability from csaf_certbund - Published: 2026-06-07 22:00 - Updated: 2026-07-01 22:00

Summary

Kemp LoadMaster: Mehrere Schwachstellen

Severity

Kritisch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: LoadMaster ist eine Load Balancer Lösung von Progress Software.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Kemp LoadMaster ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren oder beliebigen Code auszuführen.

Betroffene Betriebssysteme: - Sonstiges

CVE-2026-33691

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Progress Software LoadMaster LTSF <7.2.54.18 Kemp / LoadMaster		LTSF <7.2.54.18
Progress Software LoadMaster GA <7.2.63.2 Kemp / LoadMaster		GA <7.2.63.2

CVE-2026-8037

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Progress Software LoadMaster LTSF <7.2.54.18 Kemp / LoadMaster		LTSF <7.2.54.18
Progress Software LoadMaster GA <7.2.63.2 Kemp / LoadMaster		GA <7.2.63.2

References

7 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://community.progress.com/s/article/LoadMast…	external
https://www.cve.org/CVERecord?id=CVE-2026-8037	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33691	external
https://labs.watchtowr.com/enterprise-tech-in-she…	external
https://www.esentire.com/security-advisories/prog…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "kritisch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "LoadMaster ist eine Load Balancer L\u00f6sung von Progress Software.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Kemp LoadMaster ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren oder beliebigen Code auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1812 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1812.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1812 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1812"
      },
      {
        "category": "external",
        "summary": "LoadMaster Critical Security Bulletin vom 2026-06-07",
        "url": "https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691"
      },
      {
        "category": "external",
        "summary": "CVERecord vom 2026-06-07",
        "url": "https://www.cve.org/CVERecord?id=CVE-2026-8037"
      },
      {
        "category": "external",
        "summary": "NIST Vulnerability Database vom 2026-06-07",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33691"
      },
      {
        "category": "external",
        "summary": "Watchtowr Vulnerability Research vom 2026-06-30",
        "url": "https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/"
      },
      {
        "category": "external",
        "summary": "Esentire Security Advisory vom 2026-07-01",
        "url": "https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037"
      }
    ],
    "source_lang": "en-US",
    "title": "Kemp LoadMaster: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-07-01T22:00:00.000+00:00",
      "generator": {
        "date": "2026-07-02T08:30:53.855+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1812",
      "initial_release_date": "2026-06-07T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-06-07T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-06-09T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: ZDI-26-342, ZDI-CAN-30437, ZDI-26-340, ZDI-CAN-30438, ZDI-26-341, ZDI-CAN-30439"
        },
        {
          "date": "2026-06-30T22:00:00.000+00:00",
          "number": "3",
          "summary": "PoC aufgenommen"
        },
        {
          "date": "2026-07-01T22:00:00.000+00:00",
          "number": "4",
          "summary": "Aktive Ausnutzung gemeldet"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "GA \u003c7.2.63.2",
                "product": {
                  "name": "Progress Software LoadMaster GA \u003c7.2.63.2",
                  "product_id": "T055029"
                }
              },
              {
                "category": "product_version",
                "name": "GA 7.2.63.2",
                "product": {
                  "name": "Progress Software LoadMaster GA 7.2.63.2",
                  "product_id": "T055029-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:kemptechnologies:loadmaster:ga__7.2.63.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "LTSF \u003c7.2.54.18",
                "product": {
                  "name": "Progress Software LoadMaster LTSF \u003c7.2.54.18",
                  "product_id": "T055030"
                }
              },
              {
                "category": "product_version",
                "name": "LTSF 7.2.54.18",
                "product": {
                  "name": "Progress Software LoadMaster LTSF 7.2.54.18",
                  "product_id": "T055030-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:kemptechnologies:loadmaster:ltsf__7.2.54.18"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "LoadMaster"
          }
        ],
        "category": "vendor",
        "name": "Kemp"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-33691",
      "product_status": {
        "known_affected": [
          "T055030",
          "T055029"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-33691"
    },
    {
      "cve": "CVE-2026-8037",
      "product_status": {
        "known_affected": [
          "T055030",
          "T055029"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-8037"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-33691 (GCVE-0-2026-33691)

CERTFR-2026-AVI-0883

Solutions

FKIE_CVE-2026-33691

ubuntu-cve-2026-33691

Vulnerability from osv_ubuntu

WID-SEC-W-2026-1812

Tags

Sightings

Nomenclature