CVE-2022-39957
Reported by ncsc.ch · Published September 20, 2022
The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web application firewall. A restricted resource, access to which would ordinarily be detected, may therefore bypass detection. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| owasp_modsecurity_core_rule_set | owasp | 3.3.3, 3.2.2 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| OWASP | ModSecurity Core Rule Set | 3.0.x, 3.1.x, unspecified |
| OWASP | ModSecurity Core Rule Set | *, *, 3.0.x |
Timeline
- Sep 20, 2022 CVE Published
- Sep 20, 2022 EPSS Score (30 in total, the first dated here)
- Nov 3, 2025 CVE Updated
- Mar 10, 2026 Security Advisory (2 in total, the first dated here)
- Jun 17, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2022-39957
vulnetix vdb fixes CVE-2022-39957Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2022-39957/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- FEDORA-2022-90708b46e3 vendor-advisory
- FEDORA-2022-85a85c84b3 vendor-advisory
- FEDORA-2022-1fd73a5285 vendor-advisory
- [debian-lts-announce] 20230130 [SECURITY] [DLA 3293-1] modsecurity-crs security update mailing-list
- GLSA-202305-25 vendor-advisory
- https://lists.debian.org/debian-lts-announce/2025/08/msg00004.html advisory