CVE-2026-103932: medium-severity vulnerability in owasp-modsecurity ModSecurity
ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.8
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Affected products
owasp-modsecurity · ModSecurityRelated CVEs — owasp-modsecurity ModSecurity
In the same product, most dangerous first.
CVE-2025-48866HIGHModSecurity has possible DoS vulnerability in sanitiseArg actionEPSS 0.9%CVE-2025-47947HIGHModSecurity Has Possible DoS VulnerabilityEPSS 0.6%CVE-2025-27110HIGHLibmodsecurity3 has possible bypass of encoded HTML entitiesEPSS 0.5%CVE-2026-52747HIGHModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypassEPSS 0.5%CVE-2026-30923HIGHlibModSecurity3 denial of service via segfault when using t:hexDecode on single-character query stringsEPSS 0.4%CVE-2026-52761MEDIUMModSecurity: Transformation utf8toUnicode produces wrong output on i386 architectureEPSS 0.4%