The Core Rule Set rule 922110 mismanages multipart requests that contain several content‑type parts. While looping over the headers of each part, the rule populates capture variables for the charset but overwrites them on each iteration. Only the charset from the final part is retained, meaning an attacker can place malicious charsets in earlier parts and have them ignored. The rule chain therefore fails to detect the attack and treats the request as legitimate.

Deployments that rely on the OWASP ModSecurity Core Rule Set from the OWASP project, using any version prior to 3.3.8 or 4.22.0, are affected. Such deployments are common in web application firewalls that depend on the CRS for generic attack detection.

The issue carries a severity score of 9.3 on the standard scoring system, indicating a critical risk to coverage of protected applications. Predictive modeling shows an exploitation likelihood below 1 %. The vulnerability is not currently listed in the known exploited vulnerabilities catalogues. An attacker must craft multipart HTTP requests that contain multiple content‑type parts. The vector is remote via a web interface, and successful exploitation would allow the bypass of all safeguards that the rule set is designed to enforce.