{"id":"CVE-2026-103932","summary":"ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match","details":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17.","aliases":["GHSA-5m93-4h75-3p2w"],"modified":"2026-11-05T21:30:59.288534975Z","published":"2026-11-05T15:42:46.251Z","database_specific":{"cwe_ids":["CWE-253"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103932.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103932.json"},{"type":"FIX","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/d92bdc3b2183824ba3c582154b7385ee8349ea7e"},{"type":"WEB","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"},{"type":"ADVISORY","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103932"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/owasp-modsecurity/modsecurity","events":[{"introduced":"bf881a4eda343d37629e39ede5e28b70dc4067c0"},{"fixed":"1925753989ccce977cdaae417b55c9726c7cf02c"},{"fixed":"d92bdc3b2183824ba3c582154b7385ee8349ea7e"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"3.0.5"},{"fixed":"3.0.17"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"fixed":"d92bdc3b2183824ba3c582154b7385ee8349ea7e"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"1925753989ccce977cdaae417b55c9726c7cf02c"}],"source":"REFERENCES_TAG","original_tag":"v3.0.17"}]}}],"versions":["v3.0.16","v3.0.15","v3.0.14","v3.0.13","v3.0.12","v3.0.11","v3.0.10","v3.0.9","v3.0.8","v3.0.7","v3.0.6","v3.0.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103932.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"}]}