CVE-2026-103932 · Package
NO FIX YET · SEE WHAT TO DO
ModSecurity's PCRE2 @rxGlobal operator treats match-limit errors as no match, so rules that depend on the limit indicator do not run. An attacker can send input that exhausts SecPcreMatchLimit and get a request through that should have been blocked.
first public Sep 30, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only deployments running ModSecurity 3 with PCRE2 where rules use @rxGlobal with an expression that can exhaust the match limit, plus a compensating rule that checks MSC_PCRE_LIMITS_EXCEEDED or its TX indicator. The sources say this is not a universal WAF bypass. Teams without that rule pattern can deprioritize it.
Not affected if default-config, no-rxglobal-rules, pcre-limit-rules-absent
Who cares apache, iis, modsecurity, nginx, waf
@rxGlobal used together with MSC_PCRE_LIMITS_EXCEEDED or the matching TX indicator.SecPcreMatchLimit.3.0.17.ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.