{"id":"CVE-2026-44982","revision":null,"records":[{"revision":"eb4543d936a74417b9d680bca4c978d9","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-44982","aliases":[],"title":"CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests","description":"CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from max(r.ContentLength, 0), so HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests without a content-length header produced an empty body and caused WAF rules targeting REQUEST_BODY, BODY_ARGS, ARGS_POST, JSON, or XML to be skipped. This issue is fixed in version 1.7.8.","state":0,"publishedAt":"2026-07-16T19:50:26.067+00:00","modifiedAt":"2026-07-17T15:01:59.005+00:00","affected":[{"ecosystem":"Vendor product","name":"crowdsec","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"crowdsecurity\",\n                    \"product\": \"crowdsec\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 1.5.0, < 1.7.8\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","score":7.2,"severity":"HIGH"}],"references":["https://github.com/crowdsecurity/crowdsec/security/advisories/GHSA-rw47-hm26-6wr7","https://github.com/crowdsecurity/crowdsec/pull/4355","https://github.com/crowdsecurity/crowdsec/commit/3d5c4d9b127091e9063b9b5eb785372a599a4435","https://github.com/crowdsecurity/crowdsec/commit/57a793548671e6bbd2cde5562fe87b856ec9c642","https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.8"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-44982","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-44982","identifiers":["CVE-2026-44982"]},"retained":false,"historicalAffected":[]},{"revision":"47d33125fd9641988ec7b00c86005920","observedAt":"2026-10-25T10:17:33.838+00:00","statement":{"source":"nvd","id":"CVE-2026-44982","aliases":[],"title":"CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from max(r.ContentLength, 0), so HTTP/1.1 requests using Transfer-Encod…","description":"CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from max(r.ContentLength, 0), so HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests without a content-length header produced an empty body and caused WAF rules targeting REQUEST_BODY, BODY_ARGS, ARGS_POST, JSON, or XML to be skipped. This issue is fixed in version 1.7.8.","state":0,"publishedAt":"2026-07-16T20:16:45.033+00:00","modifiedAt":"2026-10-24T20:10:00.137+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","score":7.2,"severity":"HIGH"}],"references":["https://github.com/crowdsecurity/crowdsec/commit/3d5c4d9b127091e9063b9b5eb785372a599a4435","https://github.com/crowdsecurity/crowdsec/commit/57a793548671e6bbd2cde5562fe87b856ec9c642","https://github.com/crowdsecurity/crowdsec/pull/4355","https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.8","https://github.com/crowdsecurity/crowdsec/security/advisories/GHSA-rw47-hm26-6wr7"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44982","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-693"],"productCriteria":[],"sourceDates":{"published":"2026-07-16T20:16:45.033","lastModified":"2026-10-24T20:10:00.137"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-44982","identifiers":["CVE-2026-44982"]},"retained":false,"historicalAffected":[]},{"revision":"fa75aac08e934131ac939bc5a4c67d00","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-rw47-hm26-6wr7","aliases":["CVE-2026-44982","GO-2026-5641"],"title":"CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests","description":"## Summary\n\nThe CrowdSec AppSec component fails to read the HTTP request body for any request whose `Content-Length` is not positive — most notably HTTP/1.1 requests using `Transfer-Encoding: chunked` and HTTP/2 requests sent without a `content-length` header. Coraza is then evaluated against an empty body, so every WAF rule targeting `REQUEST_BODY`, `BODY_ARGS`, `ARGS_POST`, `JSON`, or `XML` silently fails to match.\n\nAn unauthenticated remote attacker can bypass the entire AppSec body-inspection pipeline  by changing a single framing header on an otherwise-malicious request. The bypassed request is forwarded as `allow` and produces no WAF log entry.\n\n## Affected versions\n\n- `github.com/crowdsecurity/crowdsec` — all releases up to and including **v1.7.7**.\n\n## Affected component\n\n`pkg/appsec/request.go`, function `NewParsedRequestFromRequest`.\n\n## Root cause\n\n```go\nfunc NewParsedRequestFromRequest(r *http.Request, logger *log.Entry) (ParsedRequest, error) {\n    var err error\n    contentLength := max(r.ContentLength, 0)\n    body := make([]byte, contentLength)\n    if r.Body != nil {\n        _, err = io.ReadFull(r.Body, body)\n        if err != nil {\n            return ParsedRequest{}, fmt.Errorf(\"unable to read body: %s\", err)\n        }\n        r.Body = io.NopCloser(bytes.NewBuffer(body))\n    }\n    ...\n}\n```\n\nGo's `net/http` server sets `r.ContentLength = -1` when the request uses `Transfer-Encoding: chunked` with no `Content-Length` header, or when an HTTP/2 request omits the `content-length` pseudo-header (DATA-frame-only body). With `ContentLength == -1`:\n\n1. `max(-1, 0)` evaluates to `0`.\n2. `make([]byte, 0)` allocates a zero-length slice.\n3. `io.ReadFull` on a zero-length buffer needs zero bytes and returns immediately without touching `r.Body`.\n4. The empty buffer is written back onto the request and onto the cloned request constructed later in the same function.\n\nEvery downstream consumer then sees an empty body. In the AppSec runner, `WriteRequestBody` is skipped because the parsed body has zero length, and `ProcessRequestBody` runs against nothing.\n\n## Impact\n\nEvery body-scanning rule is bypassed for any request whose framing makes `Content-Length` non-positive. In default CrowdSec deployments using the standard AppSec collections, the bypass affects any rule with `zones` containing `BODY_ARGS`, `JSON`, `XML`, `REQUEST_BODY`, or `ARGS_POST`.\n\nNo configuration option mitigates the issue — the defect is in the request parser, not in any ruleset. Bypassed requests do not produce a WAF log entry, so operators have no signal that rules are being skipped.\n\nHeader-only and URI-only rules are unaffected.\n\n## Workarounds\n\nNo complete workaround is available.","state":0,"publishedAt":"2026-05-27T19:58:15+00:00","modifiedAt":"2026-06-25T23:11:30.6429124+00:00","affected":[{"ecosystem":"Go","name":"github.com/crowdsecurity/crowdsec","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.5.0"},{"kind":"fixed","version":"1.7.8"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/crowdsecurity/crowdsec/security/advisories/GHSA-rw47-hm26-6wr7","https://github.com/crowdsecurity/crowdsec"],"sourceUrl":"https://github.com/advisories/GHSA-rw47-hm26-6wr7","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-rw47-hm26-6wr7","identifiers":["GHSA-rw47-hm26-6wr7","CVE-2026-44982","GO-2026-5641"]},"retained":false,"historicalAffected":[]},{"revision":"e1b40bb35fcb4f43a8b85314634f25fa","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5641","aliases":["CVE-2026-44982","GHSA-rw47-hm26-6wr7"],"title":"CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests in github.com/crowdsecurity/crowdsec","description":"CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests in github.com/crowdsecurity/crowdsec","state":0,"publishedAt":"2026-06-25T22:34:38+00:00","modifiedAt":"2026-06-25T23:01:37.4529659+00:00","affected":[{"ecosystem":"Go","name":"github.com/crowdsecurity/crowdsec","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.5.0"},{"kind":"fixed","version":"1.7.8"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/crowdsecurity/crowdsec/security/advisories/GHSA-rw47-hm26-6wr7"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5641","license":"OSV · upstream source license applies","key":"osv:GO-2026-5641","identifiers":["GO-2026-5641","CVE-2026-44982","GHSA-rw47-hm26-6wr7"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-27T04:23:20.6482565+00:00","complete":true,"records":1758,"lastAttemptAt":"2026-10-27T04:23:20.6482565+00:00","lastSuccessAt":"2026-10-27T04:23:21.0403366+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:21.0403386+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-187d2b72c94ceb8c4417f1032ec3109a3a3a7b730abadb561d8cdd2a96e04d27-44adb5fc4ec2447b4a14a9a186d21f635f5ab0fe59c9ca03fbd7387196ed1b95","complete":true,"records":414861,"lastAttemptAt":"2026-10-27T04:23:19.4839227+00:00","lastSuccessAt":"2026-10-27T04:23:19.4592214+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:19.4839227+00:00","snapshotPublishedAt":"2026-10-27T03:23:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-27T04:24:29.5120624+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":0,"expectedIdentifiers":13477},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-27T04:23:20.6482565+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-27T04:23:20.6482565+00:00","lastSuccessAt":"2026-10-27T04:23:21.0415276+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:21.0415281+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1e75823a9a3a4b74973abff44e356610","complete":false,"records":13416,"lastAttemptAt":"2026-10-27T04:24:27.4557647+00:00","lastSuccessAt":"2026-10-27T04:24:27.452+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:24:27.452+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13077,"expectedIdentifiers":13477},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-c3121b113ecd88f1c92ccfa0ec9757ddc8386e4c12afd2597450b815744f800a","complete":true,"records":9779,"lastAttemptAt":"2026-10-27T04:23:20.1429206+00:00","lastSuccessAt":"2026-10-26T15:37:14.3083004+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:20.1429206+00:00","snapshotPublishedAt":"2026-10-26T14:48:41+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-27T04:23:19.6550338+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:19.6550338+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-a393d8fe0ae8408f3e4cab413b76047090c8e4a3c0a186c79edf33c9a3d3af95","complete":true,"records":2995,"lastAttemptAt":"2026-10-27T04:23:20.5252815+00:00","lastSuccessAt":"2026-10-26T14:35:47.9640893+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:20.5252815+00:00","snapshotPublishedAt":"2026-10-26T14:18:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-2c2579bb03487537529e2b647fd2d9950cfc0fec1a9832dba33e322b8dcbe369","complete":true,"records":230812,"lastAttemptAt":"2026-10-27T04:23:20.0379863+00:00","lastSuccessAt":"2026-10-26T21:37:26.5810298+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:20.0379863+00:00","snapshotPublishedAt":"2026-10-26T21:33:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}