OWASP CRS: Regular expression denial of service in RCE detection rules
Summary
The OWASP Core Rule Set (CRS) provides generic attack detection rules for web application firewalls such as ModSecurity. A shared regex include used by 12 Unix RCE rules in CRS v4, and four manually assembled rules in CRS v3.3, contains an ambiguous pattern. A single unauthenticated, crafted request can exceed the PCRE2 backtracking limit, so the @rx operator returns an error instead of a match, which allows detection bypass and CPU denial of service on the WAF.
Affected
- OWASP CRS versions below 3.3.10
- OWASP CRS versions below 4.25.1
- OWASP CRS versions below 4.28.0
- Versions 4.26.x and 4.27.x are not named as fixed in the sources; treat them as affected until verified.
- Products that bundle CRS, such as ModSecurity or Coraza setups, are affected if they ship a vulnerable CRS version.
Fixed in
- CRS 3.3.10
- CRS 4.25.1 (LTS line)
- CRS 4.28.0
- A later release (v4.29.0) exists; the sources do not confirm its contents against this CVE.
Workaround
- The vendor does not recommend disabling the affected rules, because this also removes the RCE detection they provide.
- No other mitigation is documented. Upgrading is the fix.
Exploitation
- Not known to be exploited as of 11 Nov 2026 (OffSeq).
- No public proof of concept or CISA KEV entry was found in the research. This means nothing is known so far, not confirmed absence.
Our recommendation
- Inventory all ModSecurity, Coraza, appliance and container images that include CRS, and record their versions.
- Upgrade to CRS 4.28.0 or later, 4.25.1 on the LTS line, or 3.3.10 for v3.
- Check the WAF for slow requests, CPU spikes and unusual log entries. Do not disable the RCE rules.
- If a managed WAF or hosting provider runs CRS for you, ask them to confirm the update.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (CVE Program) www.cve.org
- GitHub Security Advisory GHSA-f5qm-3h4p-8qhg github.com
- CRS release announcement 4.28.0, 4.25.1 LTS and 3.3.10 coreruleset.org
- CRS release v4.28.0 github.com
- Fix commit 4665b6d github.com
- Fix commit 6083611 github.com
- VulDB entry 435891 vuldb.com
- OffSeq threat radar entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:21.
Original description (NVD)
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service (ReDoS) affects a shared regex-assembly include used to build 12 Unix RCE detection rules in CRS v4, and the same ambiguous pattern was present in the manually-assembled regexes in 4 rules in CRS v3.3. With a single, unauthenticated, crafted request, the generated pattern drives PCRE2 past its backtracking limit. When PCRE2 exceeds that limit, the @rx operator returns an error rather than a match result, which results in detection bypass and CPU denial of service. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0.
NVD references (4)
- https://github.com/coreruleset/coreruleset/commit/4665b6d7a79a81aa8a802ef3c901d69491c009a4
- https://github.com/coreruleset/coreruleset/commit/6083611d00291e85ab7b587e96577deb53ed9cac
- https://github.com/coreruleset/coreruleset/commit/e3b612a909532dcc8d056c01ac04b31117b71505
- https://github.com/coreruleset/coreruleset/security/advisories/GHSA-f5qm-3h4p-8qhg
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.