Regular Expression Denial of Service in OWASP Core Rule Set Affecting Web Application Firewalls
CVE-2026-61619

8.8HIGH

Key Information:

Vendor

Coreruleset

Status
Coreruleset
Vendor
CVE Published:
11 November 2026

What is CVE-2026-61619?

The vulnerability affects the OWASP Core Rule Set (CRS), specifically impacting web application firewalls utilizing certain regex rules. Prior to the fixed versions, attackers could exploit a crafted request to invoke backtracking in the PCRE2 engine, leading to potential denial of service through detection bypass. This security flaw has been remediated in subsequent releases, highlighting the importance of keeping firewall components updated.

Affected Version(s)

coreruleset < 3.3.10 < 3.3.10

coreruleset < 4.25.1 < 4.25.1

coreruleset < 4.28.0 < 4.28.0

References

https://github.com/coreruleset/coreruleset/security/advis...
x_refsource_CONFIRM
https://github.com/coreruleset/coreruleset/commit/4665b6d...
x_refsource_MISC
https://github.com/coreruleset/coreruleset/commit/6083611...
x_refsource_MISC

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.