Re: [CVE-2026-33691] OWASP CRS whitespace padding bypass vulnerability

[Solar Designer <solar () openwall com>]

Hi,

On Sat, Apr 18, 2026 at 08:14:12AM -0400, cyber security wrote:
> Also you can use CVE-2026-33691, to disable security headers while bypassing CRS
>
> More info at https://unlockoldupload.hashnode.dev/turn-off-security-headers-using-cve-2026-33691

This gives a 404 Page Not Found, but more importantly actual content
should have been directly included in your posting, not only referenced
via a link (although providing a link as well would then be OK).

> On Sat, Apr 18, 2026 at 3:00 AM cyber security <cs7778503 () gmail com> wrote:
> > After deep analysis we confirm, that CVE-2026-33691 aka it alias
> > UnlockOldUpload, can even disable ModSecurity WAF
> >
> > More info at https://unlockoldupload.hashnode.dev/disable-modsecurity-waf-using-cve-2026-33691.

This one exists.  The gist of it is:

"upload a file called .htaccess with the content SecRuleEngine Off"

which should have been directly in your message.

With this, I think you've said enough about this CVE already, and should
stop here - no further examples are needed.

Thanks,

Alexander