ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in v
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Owasp-Modsecurity
- Product
- ModSecurity
- CVSS v3.1
- 5.8 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
- Fix
- available
- Weakness
- CWE-253
- Exposure class
- Web platform
- NVD status
- Received
Why it ranks 34 (Notable)
- CVSS v3.1 5.8 medium
- Product class: web platform
- Widely deployed vendor product (Owasp-Modsecurity)
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-103932 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.