Cloudanix VulnDB

CVE-2026-44982

High · 7.2

CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests

CVSS

7.2

EPSS

0.4%

Published

May 27, 2026

CISA due date

—

The record

The CrowdSec AppSec component fails to read the HTTP request body for any request whose `Content-Length` is not positive — most notably HTTP/1.1 requests using `Transfer-Encoding: chunked` and HTTP/2 requests sent without a `content-length` header. Coraza is then evaluated against an empty body, so every WAF rule targeting `REQUEST_BODY`, `BODY_ARGS`, `ARGS_POST`, `JSON`, or `XML` silently fails to match. An unauthenticated remote attacker can bypass the entire AppSec body-inspection pipeline by changing a single framing header on an otherwise-malicious request. The bypassed request is forwarded as `allow` and produces no WAF log entry.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities