{"id":"CVE-2026-61619","kind":"vulnerability","aliases":["CVE-2026-61619"],"related":[],"title":"OWASP CRS: one crafted request bypasses RCE detection and burns CPU","description":"The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service (ReDoS) affects a shared regex-assembly include used to build 12 Unix RCE detection rules in CRS v4, and the same ambiguous pattern was present in the manually-assembled regexes in 4 rules in CRS v3.3. With a single, unauthenticated, crafted request, the generated pattern drives PCRE2 past its backtracking limit. When PCRE2 exceeds that limit, the @rx operator returns an error rather than a match result, which results in detection bypass and CPU denial of service. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0.","summary":"The OWASP Core Rule Set has a regular-expression denial-of-service flaw in a shared pattern used by 12 Unix RCE detection rules in v4 and 4 rules in v3.3. One unauthenticated crafted request makes PCRE2 hit its backtracking limit, so the @rx operator returns an error instead of a match, which bypasses detection and exhausts CPU.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["modsecurity","other","owasp-crs","waf"],"not_affected_if":["crs-not-used","no-waf"],"how_to_check":null,"fix":"- Move CRS 3.3.x to `3.3.10` or later.\n- Move CRS 4.25.x to `4.25.1` or later.\n- Move CRS 4.28.x to `4.28.0` or later.","status":"open","published_at":"2026-11-11T18:19:47+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","triaged_at":"2026-11-11T18:29:22+00:00","updated_at":"2026-11-11T18:29:22+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T18:29:22Z","model":"claude-haiku-5-5","output":{"fix":"- Move CRS 3.3.x to `3.3.10` or later.\n- Move CRS 4.25.x to `4.25.1` or later.\n- Move CRS 4.28.x to `4.28.0` or later.","reach":"internet","title":"OWASP CRS: one crafted request bypasses RCE detection and burns CPU","impact":"high","summary":"The OWASP Core Rule Set has a regular-expression denial-of-service flaw in a shared pattern used by 12 Unix RCE detection rules in v4 and 4 rules in v3.3. One unauthenticated crafted request makes PCRE2 hit its backtracking limit, so the @rx operator returns an error instead of a match, which bypasses detection and exhausts CPU.","audience":"businesses","category":"other","nicknames":[],"who_cares":["owasp-crs","modsecurity","waf"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker bypasses WAF rule detection and exhausts server CPU","analyst_note":"","how_to_check":"unknown","plain_action":"","product_name":"OWASP CRS","needs_analyst":false,"not_affected_if":["no-waf","crs-not-used"],"who_is_affected":"Sites and services that run the OWASP Core Rule Set in a web application firewall, typically ModSecurity, are exposed because the flawed rules run on every inbound request. Teams that do not use CRS with a WAF, or that run a patched version, can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001347,"input_tokens":4781,"output_tokens":1737,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-61619':14A,17A '12':45B,129C '3.3.10':108C,204C '4':53B,151C '4.25.1':109C,205C '4.28.0':111C,207C 'affect':119C 'ambigu':140C 'applic':103C 'assembl':124C,148C 'attack':95C 'backtrack':65B,169C 'build':128C 'burn':10A 'bypass':6A,79B,191C 'compat':101C 'core':26B,86C 'cpu':11A,83B,193C 'craft':4A,59B,160C 'crs':2A,22B,89C,135C,154C 'cve':12A,15A 'denial':35B,115C,194C 'denial-of-servic':34B 'detect':8A,48B,80B,96C,132C,190C 'drive':165C 'error':73B,181C 'exceed':173C 'exhaust':82B 'express':33B,114C 'firewal':104C 'flaw':38B 'generat':163C 'generic':94C 'hit':63B 'includ':125C 'instead':74B 'issu':198C 'limit':66B,170C,175C 'make':61B 'manual':147C 'manually-assembl':146C 'match':77B,185C 'modsecur':18B 'one':3A,57B 'oper':70B,178C 'owasp':1A,21B,25B,85C 'owasp-cr':20B 'past':167C 'patch':201C 'pattern':42B,141C,164C 'pcre2':62B,166C,172C 'present':143C 'prior':105C 'rather':182C 'rce':7A,47B,131C 'redo':118C 'regex':123C,149C 'regex-assembl':122C 'regular':32B,113C 'regular-express':31B,112C 'request':5A,60B,161C 'result':186C,188C 'return':71B,179C 'rule':27B,49B,54B,87C,97C,133C,152C 'rx':69B,177C 'servic':37B,117C,196C 'set':28B,88C,92C 'share':41B,121C 'singl':158C 'unauthent':58B,159C 'unix':46B,130C 'use':43B,99C,126C 'v3.3':56B,155C 'v4':51B,136C 'version':107C,203C 'waf':23B 'web':102C","nicknames":[],"mitigations":[],"who_affected":"Sites and services that run the OWASP Core Rule Set in a web application firewall, typically ModSecurity, are exposed because the flawed rules run on every inbound request. Teams that do not use CRS with a WAF, or that run a patched version, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","modsecurity","other","owaspcrs","waf"],"campaign_type":null,"search_a":"'-2026':13A,16A '-61619':14A,17A 'burn':10A 'bypass':6A 'cpu':11A 'craft':4A 'crs':2A 'cve':12A,15A 'detect':8A 'one':3A 'owasp':1A 'rce':7A 'request':5A","search_b":"'12':45B '4':53B 'backtrack':65B 'bypass':79B 'core':26B 'cpu':83B 'craft':59B 'crs':22B 'denial':35B 'denial-of-servic':34B 'detect':48B,80B 'error':73B 'exhaust':82B 'express':33B 'flaw':38B 'hit':63B 'instead':74B 'limit':66B 'make':61B 'match':77B 'modsecur':18B 'one':57B 'oper':70B 'owasp':21B,25B 'owasp-cr':20B 'pattern':42B 'pcre2':62B 'rce':47B 'regular':32B 'regular-express':31B 'request':60B 'return':71B 'rule':27B,49B,54B 'rx':69B 'servic':37B 'set':28B 'share':41B 'unauthent':58B 'unix':46B 'use':43B 'v3.3':56B 'v4':51B 'waf':23B","search_c":"'12':129C '3.3.10':108C,204C '4':151C '4.25.1':109C,205C '4.28.0':111C,207C 'affect':119C 'ambigu':140C 'applic':103C 'assembl':124C,148C 'attack':95C 'backtrack':169C 'build':128C 'bypass':191C 'compat':101C 'core':86C 'cpu':193C 'craft':160C 'crs':89C,135C,154C 'denial':115C,194C 'detect':96C,132C,190C 'drive':165C 'error':181C 'exceed':173C 'express':114C 'firewal':104C 'generat':163C 'generic':94C 'includ':125C 'issu':198C 'limit':170C,175C 'manual':147C 'manually-assembl':146C 'match':185C 'oper':178C 'owasp':85C 'past':167C 'patch':201C 'pattern':141C,164C 'pcre2':166C,172C 'present':143C 'prior':105C 'rather':182C 'rce':131C 'redo':118C 'regex':123C,149C 'regex-assembl':122C 'regular':113C 'regular-express':112C 'request':161C 'result':186C,188C 'return':179C 'rule':87C,97C,133C,152C 'rx':177C 'servic':117C,196C 'set':88C,92C 'share':121C 'singl':158C 'unauthent':159C 'unix':130C 'use':99C,126C 'v3.3':155C 'v4':136C 'version':107C,203C 'web':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-03T07:11:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61619","severity":null,"published_at":"2026-11-11T18:19:47+00:00","modified_at":"2026-11-11T18:19:47+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","fetched_at":"2026-11-11T18:28:43+00:00","note":null}],"documents":[{"id":127735,"url":"https://github.com/coreruleset/coreruleset/commit/4665b6d7a79a81aa8a802ef3c901d69491c009a4","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":127736,"url":"https://github.com/coreruleset/coreruleset/commit/6083611d00291e85ab7b587e96577deb53ed9cac","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":127737,"url":"https://github.com/coreruleset/coreruleset/commit/e3b612a909532dcc8d056c01ac04b31117b71505","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":127738,"url":"https://github.com/coreruleset/coreruleset/security/advisories/GHSA-f5qm-3h4p-8qhg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-03T07:11:24+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}