The vulnerability arises from CrowdSec's request parsing logic in NewParsedRequestFromRequest, which allocates its request body buffer using max(r.ContentLength, 0). For HTTP/1.1 requests that use Transfer-Encoding: chunked and HTTP/2 requests that omit a Content-Length header, this calculation results in an empty body. As a consequence, WAF rules that inspect REQUEST_BODY, BODY_ARGS, ARGS_POST, JSON, or XML are skipped, allowing malicious payloads to bypass those checks. This flaw represents an insecure implementation (CWE-693) and permits attackers to evade payload inspections.

Affected users are those running CrowdSec versions 1.5.0 through 1.7.7 inclusive. Version 1.7.8 and later incorporate the fix, restoring normal request body handling.

The CVSS score of 7.2 indicates a high severity, though the EPSS score of less than 1% implies a low probability of exploitation in practice, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting HTTP/1.1 requests with Transfer-Encoding: chunked or HTTP/2 requests without a content‑length header, thereby manipulating CrowdSec into ignoring request body‑based rules. No privilege escalation or remote code execution is required; the risk is primarily a bypass of existing security checks.