CVE-2021-35368: Debian Linux

Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days.

OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 36 only; version 37 only
• Owasp Owasp Modsecurity Core Rule Set: from 3.1.0, before 3.1.2 (fixed in 3.1.2); from 3.2.0, before 3.2.1 (fixed in 3.2.1); from 3.3.0, before 3.3.2 (fixed in 3.3.2)

Published 2021-11-05. Last modified 2026-06-17.