VulnSocial

CVE-2026-44982

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from max(r.ContentLength, 0), so HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests without a content-length header produced an empty body and caused WAF rules targeting REQUEST_BODY, BODY_ARGS, ARGS_POST, JSON, or XML to be skipped. This issue is fixed in version 1.7.8.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-693

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-23: 109-23
Referenced assets1 URL
Full discourse1 post
  • !Manan@0xManan

    CrowdSec WAF bypass Same payload. Same endpoint. One framing header change. 403 → 200. Body-based WAF rules never even saw the request. CVE-2026-44982 : CrowdSec AppSec. Bug: body buffer sized from max(Content-Length, 0). Chunked HTTP/1.1 or HTTP/2 without Content-Length → empty body → REQUEST_BODY / ARGS_POST / JSON / XML rules silently no-op. That’s not a “missed signature.” That’s a protection mechanism failure (CWE-693). Fixed in CrowdSec 1.7.8. Nginx/OpenResty folks: bouncer upgrade + consider APPSEC_DROP_UNREADABLE_BODY=true or you’re still half-blind on HTTP/2. If your WAF “blocks SQLi” but only when Content-Length is polite… what else is it politely ignoring? Advisory: https://github.com/crowdsecurity/crowdsec/security/advisories/GHSA-rw47-hm26-6wr7

    10021185
    2.1K followersView on X

Explore more

Back to dashboard