CVE-2026-103932 in ModSecurity
Summary
by MITRE • 11/05/2026
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/05/2026
ModSecurity serves as a prominent open-source, cross-platform web application firewall engine designed to protect applications running on Apache, IIS, and Nginx servers by inspecting HTTP traffic against configurable rule sets. Within the specific versions ranging from 3.0.5 through 3.0.17, a critical logic flaw exists in the implementation of the PCRE2 regex engine when processing global regular expression matches via the @rxGlobal operator. The core technical deficiency lies in how the system handles resource exhaustion errors during pattern matching operations. Specifically, when an attacker-controlled input causes the PCRE2 library to hit its configured match limit, defined by SecPcreMatchLimit, the ModSecurity code incorrectly converts this error condition into a standard no-match result rather than propagating a non-OK RegexResult status. This misclassification prevents the engine from recognizing that a computational resource limit was exceeded during the evaluation of the regular expression.
The operational impact of this flaw is significant for security architectures relying on compensatory rules to mitigate complex or potentially malicious inputs. Many rule sets utilize specific indicators such as MSC_PCRE_LIMITS_EXCEEDED or its transaction variable compatibility counterpart to detect when an input has triggered regex limits, often triggering a block action regardless of the pattern match outcome. Because the vulnerability causes these limit-exhaustion errors to be silently treated as simple non-matches, any rules dependent on detecting this specific condition fail to execute. Consequently, requests that are intended to be rejected due to their potential for causing denial-of-service or exploiting regex-based vulnerabilities can successfully bypass the web application firewall and reach the backend application server unfiltered.
This vulnerability is categorized under CWE-754: Improper Check for Unusual or Exceptional Conditions, as the software fails to properly handle an exceptional condition (regex limit exhaustion) that indicates a potential attack vector or resource abuse scenario. In terms of adversarial tactics, this flaw aligns with ATT&CK technique T1068: Exploitation for Privilege Escalation if it leads to unauthorized access, but more accurately reflects aspects of evasion techniques where attackers manipulate system behavior to avoid detection mechanisms. It is important to note that this issue does not constitute a universal bypass of the WAF; rather, it specifically affects PCRE2 deployments utilizing @rxGlobal with expressions capable of exhausting limits and those relying on compensating rules designed to catch such events. To mitigate this risk, organizations must upgrade their ModSecurity installation to version 3.0.17 or later, where the regex error handling logic has been corrected to properly propagate non-OK results when match limits are exceeded, thereby ensuring that protective rules function as intended against resource-exhaustion attacks.