CVE-2026-44982

HIGH 7.2

CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from max(r.ContentLength, 0), so HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests without a content-length header produced an empty body and caused WAF rules targeting REQUEST_BODY, BODY_ARGS, ARGS_POST, JSON, or XML to be skipped. This issue is fixed in version 1.7.8.

CWE	CWE-693
Vendor	crowdsecurity
Product	crowdsec
Published	Jul 16, 2026

Stay Ahead of the Next One

Get instant alerts for crowdsecurity crowdsec

Be the first to know when new high vulnerabilities affecting crowdsecurity crowdsec are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

crowdsecurity / crowdsec

>= 1.5.0, < 1.7.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/crowdsecurity/crowdsec/security/advisories/GHSA-rw47-hm26-6wr7 github.com: https://github.com/crowdsecurity/crowdsec/pull/4355 github.com: https://github.com/crowdsecurity/crowdsec/commit/3d5c4d9b127091e9063b9b5eb785372a599a4435 github.com: https://github.com/crowdsecurity/crowdsec/commit/57a793548671e6bbd2cde5562fe87b856ec9c642 github.com: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.8