CVE-2026-103932: fallo de gravedad media en owasp-modsecurity ModSecurity
ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.8epss 0.3%
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Productos afectados
owasp-modsecurity · ModSecurityCVEs relacionadas — owasp-modsecurity ModSecurity
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-48866HIGHModSecurity has possible DoS vulnerability in sanitiseArg actionEPSS 0.9%CVE-2025-47947HIGHModSecurity Has Possible DoS VulnerabilityEPSS 0.6%CVE-2026-104269HIGHModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)EPSS 0.6%CVE-2026-73856HIGHModSecurity: Response Body Inspection BypassEPSS 0.6%CVE-2025-27110HIGHLibmodsecurity3 has possible bypass of encoded HTML entitiesEPSS 0.5%CVE-2026-52747HIGHModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypassEPSS 0.5%