ModSecurity, a web application firewall engine, has a parsing flaw in versions before 3.0.16 where the multipart/form-data parser incorrectly overwrites reserved bytes instead of appending data. This causes embedded line breaks in non-file form fields to be removed before exporting to ARGS and ARGS_POST variables. Backend applications preserve these line breaks, creating a parser differential that can allow malicious payloads containing line breaks to bypass detection by rules inspecting these variables. The vulnerability is resolved in ModSecurity version 3.0.16.

Rules that inspect ARGS or ARGS_POST in ModSecurity may fail to detect malicious payloads that depend on embedded line breaks, potentially allowing attackers to bypass security controls and inject harmful input. The vulnerability does not affect confidentiality or availability but impacts the integrity of input inspection, increasing the risk of undetected attacks.

Upgrade ModSecurity to version 3.0.16 or later, where this multipart/form-data parsing issue is fixed. No other mitigation is indicated by the vendor advisory.