CVE-2026-61619: OWASP CRS: ReDoS in shared unix-shell-evasion regex-assembly include (12 RCE rules) - PCRE2 backtracking-limit exhaustion causes detection bypass and CPU DoS
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service (ReDoS) affects a shared regex-assembly include used to build 12 Unix RCE detection rules in CRS v4, and the same ambiguous pattern was present in the manually-assembled regexes in 4 rules in CRS v3.3. With a single, unauthenticated, crafted request, the generated pattern drives PCRE2 past its backtracking limit. When PCRE2 exceeds that limit, the @rx operator returns an error rather than a match result, which results in detection bypass and CPU denial of service. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OWASP CRSto a version that resolves this vulnerability.Fixed in 3.3.10 - Upgrade
Upgrade
OWASP CRSto a version that resolves this vulnerability.Fixed in 4.25.1 - Upgrade
Upgrade
OWASP CRSto a version that resolves this vulnerability.Fixed in 4.28.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using OWASP CRS with a compatible web application firewall are exposed if they run a CRS version earlier than 3.3.10, 4.25.1, or 4.28.0. The affected shared include is used by 12 Unix RCE detection rules in CRS v4; CRS v3.3 has the ambiguous pattern in four manually assembled rules.
Does exploitation require authentication or a complex attack sequence?
No. A single crafted, unauthenticated request can drive PCRE2 beyond its backtracking limit.
What happens when the vulnerable pattern is triggered?
When PCRE2 exceeds its backtracking limit, the @rx operator returns an error instead of a match result. This can bypass the affected Unix RCE detection rules and consume CPU, causing denial of service.
Which versions contain the fix?
The issue is patched in CRS versions 3.3.10, 4.25.1, and 4.28.0.