The multipart/form-data parser in ModSecurity versions prior to 3.0.16 silently removes embedded line breaks from non-file form-field values, because the parser overwrites reserved bytes instead of appending the current buffer. This behavior triggers a divergence between ModSecurity's view of the request body and that of backend applications that preserve line breaks. As a result, rules that inspect ARGS or ARGS_POST may miss malicious data that relies on line‑break delimiters, allowing attackers to bypass WAF checks that depend on the presence of such characters.

All installations of ModSecurity version 3.x running on Apache, IIS, or Nginx and using a version earlier than 3.0.16 are affected. The flaw is inherent to the default multipart/form-data parser and does not depend on particular rule sets or configuration tweaks beyond the parser's standard behavior.

The vulnerability is rated with a CVSS score of 8.6, indicating high severity. The EPSS score is below 1%, pointing to a low likelihood of exploitation at present, and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers might exploit the flaw by crafting HTTP POST requests that contain multipart/form-data payloads with line breaks embedded in form-field values, causing those payloads to be silently stripped by ModSecurity while remaining intact in the backend. No special prerequisites beyond sending the crafted request over HTTP to a vulnerable deployment are required.