DEBIAN-CVE-2026-61619: High severity debian/modsecurity-crs vulnerability
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service (ReDoS) affects a shared regex-assembly include used to build 12 Unix RCE detection rules in CRS v4, and the same ambiguous pattern was present in the manually-assembled regexes in 4 rules in CRS v3.3. With a single, unauthenticated, crafted request, the generated pattern drives PCRE2 past its backtracking limit. When PCRE2 exceeds that limit, the @rx operator returns an error rather than a match result, which results in detection bypass and CPU denial of service. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OWASP CRSto a version that resolves this vulnerability.Fixed in 3.3.10 - Upgrade
Upgrade
OWASP CRSto a version that resolves this vulnerability.Fixed in 4.25.1 - Upgrade
Upgrade
OWASP CRSto a version that resolves this vulnerability.Fixed in 4.28.0
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker only needs to send a single crafted request. No authentication or user interaction is required.
Which deployments are exposed?
Deployments using the affected CRS Unix RCE detection rules are exposed: 12 rules in CRS v4 built from the shared regex include, and 4 manually assembled rules in CRS v3.3. The issue affects versions before 3.3.10, 4.25.1, and 4.28.0.
What happens when exploitation succeeds?
The crafted request can push PCRE2 beyond its backtracking limit. This causes the regex operator to return an error instead of a match, allowing detection bypass and causing CPU denial of service.
What versions contain the fix?
The issue is patched in CRS versions 3.3.10, 4.25.1, and 4.28.0.