Web Application Firewall Vulnerability in ModSecurity by OWASP
CVE-2026-103932

5.8MEDIUM

Key Information:

Vendor

Owasp-modsecurity

Status
Modsecurity
Vendor
CVE Published:
5 November 2026

What is CVE-2026-103932?

A flaw in ModSecurity versions 3.0.5 to 3.0.16 allows attackers to exploit the PCRE2 regex implementation, resulting in the bypass of established security rules. When specific regex patterns exhaust the SecPcreMatchLimit, match-limit errors are not handled correctly. This oversight means that malicious requests can potentially pass through the WAF undetected, posing a significant risk under certain conditions. The issue has been rectified in version 3.0.17, emphasizing the importance of keeping security software updated.

Affected Version(s)

ModSecurity >= 3.0.5, < 3.0.17

References

https://github.com/owasp-modsecurity/ModSecurity/security...
x_refsource_CONFIRM
https://github.com/owasp-modsecurity/ModSecurity/commit/d...
x_refsource_MISC
https://github.com/owasp-modsecurity/ModSecurity/releases...
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.