CVE-2026-61619 · Other
NO FIX YET · SEE WHAT TO DO
The OWASP Core Rule Set has a regular-expression denial-of-service flaw in a shared pattern used by 12 Unix RCE detection rules in v4 and 4 rules in v3.3. One unauthenticated crafted request makes PCRE2 hit its backtracking limit, so the @rx operator returns an error instead of a match, which bypasses detection and exhausts CPU.
first public Jul 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites and services that run the OWASP Core Rule Set in a web application firewall, typically ModSecurity, are exposed because the flawed rules run on every inbound request. Teams that do not use CRS with a WAF, or that run a patched version, can skip it.
Not affected if crs-not-used, no-waf
Who cares modsecurity, owasp-crs, waf
Unknown from the sources.
3.3.10 or later.4.25.1 or later.4.28.0 or later.The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service (ReDoS) affects a shared regex-assembly include used to build 12 Unix RCE detection rules in CRS v4, and the same ambiguous pattern was present in the manually-assembled regexes in 4 rules in CRS v3.3. With a single, unauthenticated, crafted request, the generated pattern drives PCRE2 past its backtracking limit. When PCRE2 exceeds that limit, the @rx operator returns an error rather than a match result, which results in detection bypass and CPU denial of service. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.