Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-103932— ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match

Quick assessment

Affected

owasp-modsecurity ModSecurity

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ModSecurity 是一款开源的跨平台 Web 应用防火墙（WAF）引擎，支持 Apache、IIS 和 Nginx。在 3.0.5 至 3.0.17 版本中，src/utils/regex.cc 文件里针对 @rxGlobal 的 PCRE2 实现存在缺陷：当 pcre2_match 遇到匹配次数限制（match-limit）错误时，该实现将其转换为普通的“无匹配”结果，而非传播一个非 OK 状态的 RegexResult。因此，当攻击者控制的输入耗尽 SecPcreMatchLimit 时，依赖 MSC_P

CVSS 5.8 · Medium Updated Nov 05, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
owasp-modsecurity	ModSecurity	`>= 3.0.5, < 3.0.17`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match

Source: CVE Program / CVE List V5

Vulnerability Description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对函数返回值的检查不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
owasp-modsecurity	ModSecurity	>= 3.0.5, < 3.0.17	-

II. Public POCs for CVE-2026-103932

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-103932

请登录查看更多情报信息。

Other References for CVE-2026-103932 (3)

https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17 x_refsource_MISC
https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w x_refsource_CONFIRM
https://github.com/owasp-modsecurity/ModSecurity/commit/d92bdc3b2183824ba3c582154b7385ee8349ea7e x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-103932

Same Patch Batch · owasp-modsecurity · 2026-11-05 · 4 CVEs total

CVE-2026-73856	8.6 HIGH	ModSecurity: Response Body Inspection Bypass
CVE-2026-104269	8.6 HIGH	ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compl
CVE-2026-61813	3.7 LOW	ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download

IV. Related Vulnerabilities

Same product: ModSecurity

Same vendor: owasp-modsecurity

Same weakness: CWE-253