ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…curity/security/advisories/GHSA-5m93-4h75-3p2w Diğer
• github.com/…ommit/d92bdc3b2183824ba3c582154b7385ee8349ea7e Diğer
• github.com/…p-modsecurity/ModSecurity/releases/tag/v3.0.17 Diğer

Kayıt geçmişi

1. 5 Kas 2026 18:42Yayımlandı

İlgili açıklar

• 8,6 CVE-2026-104269ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)
• 8,6 CVE-2026-73856ModSecurity: Response Body Inspection Bypass
• 3,7 CVE-2026-61813ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download