{"id":"CVE-2026-61619","summary":"OWASP CRS: ReDoS in shared unix-shell-evasion regex-assembly include (12 RCE rules) - PCRE2 backtracking-limit exhaustion causes detection bypass and CPU DoS","details":"The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service (ReDoS) affects a shared regex-assembly include used to build 12 Unix RCE detection rules in CRS v4, and the same ambiguous pattern was present in the manually-assembled regexes in 4 rules in CRS v3.3. With a single, unauthenticated, crafted request, the generated pattern drives PCRE2 past its backtracking limit. When PCRE2 exceeds that limit, the @rx operator returns an error rather than a match result, which results in detection bypass and CPU denial of service. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0.","aliases":["GHSA-f5qm-3h4p-8qhg"],"modified":"2026-11-12T02:48:37.695875342Z","published":"2026-11-11T17:32:41.641Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-1333"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61619.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61619.json"},{"type":"FIX","url":"https://github.com/coreruleset/coreruleset/commit/4665b6d7a79a81aa8a802ef3c901d69491c009a4"},{"type":"FIX","url":"https://github.com/coreruleset/coreruleset/commit/6083611d00291e85ab7b587e96577deb53ed9cac"},{"type":"FIX","url":"https://github.com/coreruleset/coreruleset/commit/e3b612a909532dcc8d056c01ac04b31117b71505"},{"type":"ADVISORY","url":"https://github.com/coreruleset/coreruleset/security/advisories/GHSA-f5qm-3h4p-8qhg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61619"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/coreruleset/coreruleset","events":[{"introduced":"0"},{"fixed":"ab9e8bb690c8d89567076ff3598164d0ca0151b1"},{"fixed":"3b89d5a05322f448b4b74b9cadc5fb05ac6915ad"},{"fixed":"55b09f5acfd16413e7b31041100711ceb7adc89c"},{"fixed":"4665b6d7a79a81aa8a802ef3c901d69491c009a4"},{"fixed":"6083611d00291e85ab7b587e96577deb53ed9cac"},{"fixed":"e3b612a909532dcc8d056c01ac04b31117b71505"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"3.3.10"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"introduced":"0"},{"fixed":"4.25.1"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"introduced":"0"},{"fixed":"4.28.0"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"4665b6d7a79a81aa8a802ef3c901d69491c009a4"}]},{"range":[{"fixed":"6083611d00291e85ab7b587e96577deb53ed9cac"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"e3b612a909532dcc8d056c01ac04b31117b71505"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v3.3.9","v4.25.0","v4.27.0","v4.26.0","v3.3.8","v4.24.1","v4.24.0","v4.23.0","v4.22.0","v3.3.7","v4.21.0","v4.20.0","v4.19.0","v4.18.0","v4.17.1","v4.17.0","v4.16.0","v4.15.0","v4.14.0","v4.13.0","v4.12.0","nightly","v4.11.0","v4.10.0","v4.9.0","v3.3.6","v4.8.0","v4.7.0","v3.3.5","v4.6.0","v4.5.0","v4.4.0","v4.3.0","v4.2.0","v4.1.0","v4.0.0","v4.0.0-rc2","v3.3.4","v3.3.3","v3.3.2","v4.0.0-rc1","v3.3.1-rc1","v3.3.0","v3.3.0-rc2","v3.3.0-rc1","v3.2.0-rc1","v3.2-rc1","v3.1.0-rc1","v3.0.1","v3.0.0-rc3","v3.0.0-rc2","v3.0.0-rc1","v2.2.7","v2.2.6","v2.2.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61619.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}]}