CVE-2022-39958

The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body
bypass to sequentially exfiltrate small and undetectable sections of data
by repeatedly submitting an HTTP Range header field with a small byte
range. A restricted resource, access to which would ordinarily be detected,
may be exfiltrated from the backend, despite being protected by a web
application firewall that uses CRS. Short subsections of a restricted
resource may bypass pattern matching techniques and allow undetected
access. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as
the currently supported versions 3.2.1 and 3.3.2. Integrators and users are
advised to upgrade to 3.2.2 and 3.3.3 respectively and to configure a CRS
paranoia level of 3 or higher.