coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload, aka "Content-Type confusion" between the WAF and the backend application. This occurs when the web application relies on only the last Content-Type header. Other platforms may reject the additional Content-Type header or merge conflicting headers, leading to detection as a malformed header.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4488 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4488-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     February 22, 2026                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : modsecurity-crs     Version        : 3.3.4-1~deb11u2     CVE ID         : CVE-2023-38199 CVE-2026-21876     Debian Bug     : 1041109 1125084

    Multiple issues have been fixed in modsecurity-crs, a set of generic     attack detection rules for use with ModSecurity.

    CVE-2023-38199

        Coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not         detect multiple Content-Type request headers on some platforms. This         might allow attackers to bypass a WAF with a crafted payload, aka         Content-Type confusion between the WAF and the backend application.
        This occurs when the web application relies on only the last         Content-Type header. Other platforms may reject the additional         Content-Type header or merge conflicting headers, leading to detection         as a malformed header.

    CVE-2026-21876

        The current rule 922110 has a bug when processing multipart requests         with multiple parts. When the first rule in a chain iterates over a         collection (like `MULTIPART_PART_HEADERS`), the capture variables         (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last         captured value is available to the chained rule, which means malicious         charsets in earlier parts can be missed if a later part has a legitimate         charset.

    For Debian 11 bullseye, these problems have been fixed in version     3.3.4-1~deb11u2.

    We recommend that you upgrade your modsecurity-crs packages.

    For the detailed security status of modsecurity-crs please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/modsecurity-crs

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type     request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload, aka     Content-Type confusion between the WAF and the backend application. This occurs when the web application     relies on only the last Content-Type header. Other platforms may reject the additional Content-Type header     or merge conflicting headers, leading to detection as a malformed header. (CVE-2023-38199)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Siemens SINEC NMS installed on the remote host is prior to 2.0.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA-943925 advisory.

  - coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type     request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload,     aka Content-Type confusion between the WAF and the backend application. This occurs when the web     application relies on only the last Content-Type header. Other platforms may reject the additional     Content-Type header or merge conflicting headers, leading to detection as a malformed header.
    (CVE-2023-38199)

  - Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request     Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of     RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied     request-target (URL) data and is then re-inserted into the proxied request-target using variable     substitution. For example, something like: RewriteEngine on RewriteRule ^/here/(.*)     http://example.com:8080/elsewhere?$1; [P] ProxyPassReverse /here/ http://example.com:8080/ Request     splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended     URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version     2.4.56 of Apache HTTP Server. (CVE-2023-25690)

  - The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module. This vulnerability affects all users using the experimental policy     mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was     issued, the policy is an experimental feature of Node.js. (CVE-2023-32002)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
299744	Debian dla-4488 : modsecurity-crs - security update	Nessus	Debian Local Security Checks	critical
226391	Linux Distros Unpatched Vulnerability : CVE-2023-38199	Nessus	Misc.	critical
191429	Siemens SINEC NMS < V2.0 SP1 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2023-38199

critical

Tenable Plugins

critical

critical

critical