oss-security - Re: [CVE-2026-33691] OWASP CRS whitespace padding bypass vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20260418173640.GA24846@openwall.com>
Date: Sat, 18 Apr 2026 19:36:40 +0200
From: Solar Designer <solar@...nwall.com>
To: cyber security <cs7778503@...il.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: [CVE-2026-33691] OWASP CRS whitespace padding bypass vulnerability

Hi,

On Sat, Apr 18, 2026 at 08:14:12AM -0400, cyber security wrote:
> Also you can use CVE-2026-33691, to disable security headers while bypassing CRS
> 
> More info at https://unlockoldupload.hashnode.dev/turn-off-security-headers-using-cve-2026-33691

This gives a 404 Page Not Found, but more importantly actual content
should have been directly included in your posting, not only referenced
via a link (although providing a link as well would then be OK).

> On Sat, Apr 18, 2026 at 3:00 AM cyber security <cs7778503@...il.com> wrote:
> > After deep analysis we confirm, that CVE-2026-33691 aka it alias
> > UnlockOldUpload, can even disable ModSecurity WAF
> >
> > More info at https://unlockoldupload.hashnode.dev/disable-modsecurity-waf-using-cve-2026-33691.

This one exists.  The gist of it is:

"upload a file called .htaccess with the content SecRuleEngine Off"

which should have been directly in your message.

With this, I think you've said enough about this CVE already, and should
stop here - no further examples are needed.

Thanks,

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.