{"id":"CVE-2026-103932","kind":"vulnerability","aliases":["CVE-2026-103932"],"related":[],"title":"ModSecurity: regex match-limit errors let rejected requests pass the WAF","description":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17.","summary":"ModSecurity's PCRE2 @rxGlobal operator treats match-limit errors as no match, so rules that depend on the limit indicator do not run. An attacker can send input that exhausts SecPcreMatchLimit and get a request through that should have been blocked.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache","iis","modsecurity","nginx","package","waf"],"not_affected_if":["default-config","no-rxglobal-rules","pcre-limit-rules-absent"],"how_to_check":"- Confirm the ModSecurity version with the engine's version output, or check the installed package version, and see whether it falls in 3.0.5 through 3.0.17.\n- Search rule sets for `@rxGlobal` used together with `MSC_PCRE_LIMITS_EXCEEDED` or the matching TX indicator.\n- Check the server configuration for `SecPcreMatchLimit`.","fix":"- ModSecurity 3: move to `3.0.17`.","status":"open","published_at":"2026-11-05T16:17:24+00:00","first_seen_at":"2026-11-05T16:40:01+00:00","triaged_at":"2026-11-05T16:41:44+00:00","updated_at":"2026-11-05T16:41:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T16:41:44Z","model":"claude-haiku-5-5","output":{"fix":"- ModSecurity 3: move to `3.0.17`.","reach":"internet","title":"ModSecurity: regex match-limit errors let rejected requests pass the WAF","impact":"medium","summary":"ModSecurity's PCRE2 @rxGlobal operator treats match-limit errors as no match, so rules that depend on the limit indicator do not run. An attacker can send input that exhausts SecPcreMatchLimit and get a request through that should have been blocked.","audience":"businesses","category":"package","nicknames":[],"who_cares":["modsecurity","waf","apache","nginx","iis"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Requests that should be rejected pass through the WAF unchecked","analyst_note":"","how_to_check":"- Confirm the ModSecurity version with the engine's version output, or check the installed package version, and see whether it falls in 3.0.5 through 3.0.17.\n- Search rule sets for `@rxGlobal` used together with `MSC_PCRE_LIMITS_EXCEEDED` or the matching TX indicator.\n- Check the server configuration for `SecPcreMatchLimit`.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","no-rxglobal-rules","pcre-limit-rules-absent"],"who_is_affected":"Only deployments running ModSecurity 3 with PCRE2 where rules use @rxGlobal with an expression that can exhaust the match limit, plus a compensating rule that checks MSC_PCRE_LIMITS_EXCEEDED or its TX indicator. The sources say this is not a universal WAF bypass. Teams without that rule pattern can deprioritize it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000764,"input_tokens":4455,"output_tokens":638,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103932':15A,18A '-2026':14A,17A '3.0.17':87C,183C '3.0.5':85C 'affect':154C 'apach':19B,80C 'applic':75C 'attack':50B,119C 'attacker-control':118C 'block':66B 'bypass':176C 'compat':135C 'compens':168C 'control':120C 'convert':95C 'cross':72C 'cve':13A,16A 'depend':41B 'deploy':156C 'engin':78C 'error':6A,34B,101C 'exceed':131C 'exhaust':55B,122C,164C 'express':165C 'firewal':76C 'fix':180C 'get':58B 'ii':20B,81C 'implement':90C 'indic':45B,136C 'input':53B,121C 'instead':109C 'issu':153C,178C 'let':7A 'limit':5A,33B,44B,100C,130C,163C 'limit-exhaust':162C 'match':4A,32B,37B,97C,99C,107C 'match-limit':3A,31B,98C 'modsecur':1A,21B,25B,67C 'msc':128C 'nginx':22B,83C 'no-match':105C 'non':114C 'non-ok':113C 'ok':115C 'open':70C 'oper':29B 'ordinari':104C 'packag':23B 'pass':10A,148C 'pcre':129C 'pcre2':27B,89C,96C,155C 'platform':73C 'propag':111C 'regex':2A 'regexresult':116C 'reject':8A,146C 'reli':126C 'request':9A,60B,142C 'result':108C 'rule':39B,124C,169C 'run':48B,139C 'rxglobal':28B,92C,159C 'secpcrematchlimit':56B,123C 'send':52B 'sourc':71C 'src/utils/regex.cc':94C 'treat':30B 'tx':134C 'univers':174C 'use':158C 'version':182C 'waf':12A,24B,77C,151C,175C 'web':74C","nicknames":[],"mitigations":[],"who_affected":"Only deployments running ModSecurity 3 with PCRE2 where rules use @rxGlobal with an expression that can exhaust the match limit, plus a compensating rule that checks MSC_PCRE_LIMITS_EXCEEDED or its TX indicator. The sources say this is not a universal WAF bypass. Teams without that rule pattern can deprioritize it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apache","iis","medium","modsecurity","nginx","package","waf"],"campaign_type":null,"first_public_at":"2026-09-30T07:34:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103932","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103932","severity":null,"published_at":"2026-11-05T16:17:24+00:00","modified_at":"2026-11-05T16:17:24+00:00","first_seen_at":"2026-11-05T16:40:01+00:00","fetched_at":"2026-11-05T16:40:01+00:00","note":null}],"documents":[{"id":77610,"url":"https://github.com/owasp-modsecurity/ModSecurity/commit/d92bdc3b2183824ba3c582154b7385ee8349ea7e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":77611,"url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":77612,"url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-30T07:34:20+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}