CVE-2026-103932: falha de média gravidade em owasp-modsecurity ModSecurity
ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.8epss 0.3%
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Produtos afetados
owasp-modsecurity · ModSecurityCVEs relacionadas — owasp-modsecurity ModSecurity
No mesmo produto, das mais perigosas para as menos.
CVE-2025-48866HIGHModSecurity has possible DoS vulnerability in sanitiseArg actionEPSS 0.9%CVE-2025-47947HIGHModSecurity Has Possible DoS VulnerabilityEPSS 0.6%CVE-2026-104269HIGHModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)EPSS 0.6%CVE-2026-73856HIGHModSecurity: Response Body Inspection BypassEPSS 0.6%CVE-2025-27110HIGHLibmodsecurity3 has possible bypass of encoded HTML entitiesEPSS 0.5%CVE-2026-52747HIGHModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypassEPSS 0.5%