Skip to content
OpenAdvisories
Medium · 5.8 CVE-2026-103932 EUVD-2026-117551

ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match

Published Nov 5, 2026 · Updated Nov 9, 2026 · Assigned by GitHub_M

Description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17.

Affected products

VendorProductAffectedFixed
owasp-modsecurity ModSecurity >= 3.0.5, < 3.0.17 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 modsecurity No fix yet —
Debian 13 modsecurity No fix yet —
Debian 12 modsecurity No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 modsecurity No fix yet —
Ubuntu 26.04 LTS modsecurity No fix yet —
Ubuntu 24.04 LTS modsecurity No fix yet —
Ubuntu 22.04 LTS modsecurity No fix yet —
Ubuntu 20.04 LTS modsecurity No fix yet —

Advisories 1

References