CVE-2026-61619— OWASP CRS: ReDoS in shared unix-shell-evasion regex-assembly include (12 RCE rules) - PCRE2 backtracking-limit exhaustion causes detection bypass and CPU DoS

Quick assessment

Affected

coreruleset coreruleset

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OWASP 核心规则集（CRS）是一组通用的攻击检测规则，适用于兼容的 Web 应用防火墙（WAF）。在版本 3.3.10、4.25.1 和 4.28.0 之前，一个用于构建 CRS v4 中 12 条 Unix 远程代码执行（RCE）检测规则的共享正则表达式（regex）汇编包含，存在正则表达式拒绝服务（ReDoS）漏洞；同时，CRS v3.3 中手动汇编的 4 条规则也使用了相同的模糊模式。攻击者仅通过发送一个无需认证的精心构造请求，即可使生成的正则模式导致 PCRE2 引擎超出其回溯（backtracking

CVSS 8.8 · High Updated Nov 12, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1499 · Endpoint Denial of Service

Affected Version Matrix 3

Vendor	Product	Version Range	Status
coreruleset	coreruleset	`< 3.3.10`	affected
		`< 4.25.1`	affected
		`< 4.28.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OWASP CRS: ReDoS in shared unix-shell-evasion regex-assembly include (12 RCE rules) - PCRE2 backtracking-limit exhaustion causes detection bypass and CPU DoS

Source: CVE Program / CVE List V5

Vulnerability Description

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service (ReDoS) affects a shared regex-assembly include used to build 12 Unix RCE detection rules in CRS v4, and the same ambiguous pattern was present in the manually-assembled regexes in 4 rules in CRS v3.3. With a single, unauthenticated, crafted request, the generated pattern drives PCRE2 past its backtracking limit. When PCRE2 exceeds that limit, the @rx operator returns an error rather than a match result, which results in detection bypass and CPU denial of service. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1333

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
coreruleset	coreruleset	< 3.3.10	-

II. Public POCs for CVE-2026-61619

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-61619

请登录查看更多情报信息。

Other References for CVE-2026-61619 (4)

https://github.com/coreruleset/coreruleset/security/advisories/GHSA-f5qm-3h4p-8qhg x_refsource_CONFIRM
https://github.com/coreruleset/coreruleset/commit/e3b612a909532dcc8d056c01ac04b31117b71505 x_refsource_MISC
https://github.com/coreruleset/coreruleset/commit/6083611d00291e85ab7b587e96577deb53ed9cac x_refsource_MISC
https://github.com/coreruleset/coreruleset/commit/4665b6d7a79a81aa8a802ef3c901d69491c009a4 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-61619

IV. Related Vulnerabilities

Same product: coreruleset

Same vendor: coreruleset

Same weakness: CWE-1333