Log in Start free

Vulnerability · Published Nov 5, 2026 · Assigned by GitHub_M

CVE-2026-103932ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match

Medium 5.8

In plain English

A medium-severity security flaw in ModSecurity from owasp-modsecurity. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)5.8Medium
Exploit odds (30 days)0.3%top 74.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12modsecurityno fix listedDEBIAN-CVE-2026-103932
Debian:13modsecurityno fix listedDEBIAN-CVE-2026-103932
Debian:14modsecurityno fix listedDEBIAN-CVE-2026-103932
Ubuntu:22.04:LTSmodsecurityno fix listedUBUNTU-CVE-2026-103932
Ubuntu:24.04:LTSmodsecurityno fix listedUBUNTU-CVE-2026-103932
Ubuntu:26.04:LTSmodsecurityno fix listedUBUNTU-CVE-2026-103932
Ubuntu:26.10modsecurityno fix listedUBUNTU-CVE-2026-103932

Affected products (as reported)

VendorProductVersions
owasp-modsecurity ModSecurity >= 3.0.5, < 3.0.17

Weakness: CWE-253 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

References