CVE-2026-103932

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2match match-limit errors into an ordinary no-match result instead of propagating a non-OK...

CVE-2026-103932

The ModSecurity web application firewall (WAF) engine, used with Apache, IIS, and Nginx, contains a vulnerability in the PCRE2 implementation of @rxGlobal within src/utils/regex.cc. From versions 3.0.5 until 3.0.17 , the engine incorrectly converts pcre2_match match-limit errors into ordinary no-...

CVE-2026-103932 ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2match match-limit errors into an ordinary no-match result instead of propagating a non-OK...