CVE-2026-103932

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103932", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-01T14:20:19.156Z", "datePublished": "2026-11-05T15:42:46.251Z", "dateUpdated": "2026-11-09T17:14:29.857Z"}, "containers": {"cna": {"title": "ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match", "problemTypes": [{"descriptions": [{"cweId": "CWE-253", "lang": "en", "description": "CWE-253: Incorrect Check of Function Return Value", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w"}, {"name": "https://github.com/owasp-modsecurity/ModSecurity/commit/d92bdc3b2183824ba3c582154b7385ee8349ea7e", "tags": ["x_refsource_MISC"], "url": "https://github.com/owasp-modsecurity/ModSecurity/commit/d92bdc3b2183824ba3c582154b7385ee8349ea7e"}, {"name": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17", "tags": ["x_refsource_MISC"], "url": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"}], "affected": [{"vendor": "owasp-modsecurity", "product": "ModSecurity", "versions": [{"version": ">= 3.0.5, < 3.0.17", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T15:42:46.251Z"}, "descriptions": [{"lang": "en", "value": "ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17."}], "source": {"advisory": "GHSA-5m93-4h75-3p2w", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T17:14:11.605958Z", "id": "CVE-2026-103932", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:14:29.857Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-103932", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T17:14:11.605958Z"}}}], "references": [{"url": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:14:24.898Z"}}], "cna": {"title": "ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match", "source": {"advisory": "GHSA-5m93-4h75-3p2w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "owasp-modsecurity", "product": "ModSecurity", "versions": [{"status": "affected", "version": ">= 3.0.5, < 3.0.17"}]}], "references": [{"url": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w", "name": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/owasp-modsecurity/ModSecurity/commit/d92bdc3b2183824ba3c582154b7385ee8349ea7e", "name": "https://github.com/owasp-modsecurity/ModSecurity/commit/d92bdc3b2183824ba3c582154b7385ee8349ea7e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17", "name": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-253", "description": "CWE-253: Incorrect Check of Function Return Value"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T15:42:46.251Z"}}}, "cveMetadata": {"cveId": "CVE-2026-103932", "state": "PUBLISHED", "dateUpdated": "2026-11-09T17:14:29.857Z", "dateReserved": "2026-10-01T14:20:19.156Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-05T15:42:46.251Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ModSecurity", "vendor": "owasp-modsecurity", "versions": [{"status": "affected", "version": ">= 3.0.5, < 3.0.17"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17."}], "id": "CVE-2026-103932", "lastModified": "2026-11-12T22:18:35.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103932", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T17:14:11.605958Z", "version": "2.0.3"}}]}, "published": "2026-11-05T16:17:24.900", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/owasp-modsecurity/ModSecurity/commit/d92bdc3b2183824ba3c582154b7385ee8349ea7e"}, {"source": "security-advisories@github.com", "url": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"}, {"source": "security-advisories@github.com", "url": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-253"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "modsecurity: ModSecurity: Security rule bypass via regular expression limit exhaustion", "id": "2567505", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567505"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-393", "details": ["A flaw was found in ModSecurity. The regular expression engine improperly handles execution limit errors during pattern matching, treating them as ordinary non-matches instead of error conditions. A remote attacker can exploit this vulnerability by submitting crafted input designed to exceed processing limits, preventing compensating security inspection rules from executing. Consequently, malicious requests that should be rejected may bypass the web application firewall (WAF)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-103932", "public_date": "2026-11-05T15:42:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-103932\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-103932\nhttps://github.com/owasp-modsecurity/ModSecurity/commit/d92bdc3b2183824ba3c582154b7385ee8349ea7e\nhttps://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17\nhttps://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w"], "statement": "This vulnerability is evaluated as having a Moderate impact because it results in a targeted bypass of web application inspection rules rather than enabling direct code execution or host compromise. Successful exploitation depends on specific deployment prerequisites, notably configurations employing PCRE2 with the global regular expression operator alongside rule sets that rely on match-limit failure flags to block requests. Standard deployments that do not depend on error-triggered compensating rules or that utilize alternative inspection workflows remain unaffected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.5,3.0.17)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ModSecurity", "source": "cna", "vendor": "owasp-modsecurity"}, "product": "modsecurity", "vendor": "modsecurity"}], "created": "2026-11-05T16:30:12.537839+00:00", "updated": "2026-11-06T13:30:05.091468+00:00", "vendors": ["modsecurity", "modsecurity$PRODUCT$modsecurity"]}