---
id: "CVE-2026-61619"
page: "https://infrastack.ai/live/CVE-2026-61619"
kind: "vulnerability"
aliases: ["CVE-2026-61619"]
title: "OWASP CRS: one crafted request bypasses RCE detection and burns CPU"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["modsecurity", "other", "owasp-crs", "waf"]
not_affected_if: ["crs-not-used", "no-waf"]
published_at: "2026-11-11T18:19:47+00:00"
first_seen_at: "2026-11-11T18:28:43+00:00"
updated_at: "2026-11-11T18:29:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61619", "first_seen_at": "2026-11-11T18:28:43+00:00"}]
exploit_sources: []
---

# OWASP CRS: one crafted request bypasses RCE detection and burns CPU

Link for people: https://infrastack.ai/live/CVE-2026-61619 (this .md is for agents)

The OWASP Core Rule Set has a regular-expression denial-of-service flaw in a shared pattern used by 12 Unix RCE detection rules in v4 and 4 rules in v3.3. One unauthenticated crafted request makes PCRE2 hit its backtracking limit, so the @rx operator returns an error instead of a match, which bypasses detection and exhausts CPU.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

- Move CRS 3.3.x to `3.3.10` or later.
- Move CRS 4.25.x to `4.25.1` or later.
- Move CRS 4.28.x to `4.28.0` or later.

## Timeline

- 2026-11-11T18:28:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61619

## Documents

- [advisory] Vendor advisory: github.com https://github.com/coreruleset/coreruleset/security/advisories/GHSA-f5qm-3h4p-8qhg
- [fix] Patch: github.com https://github.com/coreruleset/coreruleset/commit/4665b6d7a79a81aa8a802ef3c901d69491c009a4
- [fix] Patch: github.com https://github.com/coreruleset/coreruleset/commit/6083611d00291e85ab7b587e96577deb53ed9cac
- [fix] Patch: github.com https://github.com/coreruleset/coreruleset/commit/e3b612a909532dcc8d056c01ac04b31117b71505

## From the sources

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service (ReDoS) affects a shared regex-assembly include used to build 12 Unix RCE detection rules in CRS v4, and the same ambiguous pattern was present in the manually-assembled regexes in 4 rules in CRS v3.3. With a single, unauthenticated, crafted request, the generated pattern drives PCRE2 past its backtracking limit. When PCRE2 exceeds that limit, the @rx operator returns an error rather than a match result, which results in detection bypass and CPU denial of service. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_