CVE-2026-103932: ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSCPCRELIMITSEXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ModSecurityto a version that resolves this vulnerability.Fixed in 3.0.17
Event History
Frequently Asked Questions
Which deployments are actually exposed to this bypass?
Affected deployments use the PCRE2 regex implementation and have rules using @rxGlobal with an expression whose matching can exhaust SecPcreMatchLimit, along with a compensating rule that relies on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator. It is not a universal bypass of all ModSecurity rules or deployments.
What must an attacker do to exploit the issue?
An attacker must provide input that causes an @rxGlobal expression to exhaust SecPcreMatchLimit. The resulting match-limit error is treated as a normal no-match, preventing the associated limit-exceeded handling rule from running and potentially allowing the request through.
Are default configurations necessarily affected?
No. Exposure depends on the deployed PCRE2 configuration and rule set, specifically the presence of a limit-exhaustible @rxGlobal expression and compensating limit-exceeded handling.
How can I determine whether my rules are vulnerable?
Review rules that use @rxGlobal and identify whether they depend on MSC_PCRE_LIMITS_EXCEEDED or the TX compatibility indicator to reject requests after match-limit exhaustion. Test whether attacker-controlled input can exhaust SecPcreMatchLimit for those expressions.
What version resolves the issue?
The issue is fixed in ModSecurity 3.0.17. Versions from 3.0.5 until 3.0.17 are described as affected.