Incorrect Check of Function Return Value in ModSecurity - CVE-2026-103932
Published: November 4, 2026
Vulnerability identifier: #VU159007
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-103932
CWE-ID: CWE-253
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass compensating security rules in affected ModSecurity configurations, allowing requests that should be rejected to pass through the web application firewall.
The vulnerability exists due to incorrect checking of function return values in the PCRE2 implementation of ModSecurity's @rxGlobal operator when processing input that exhausts the configured regular-expression match limit. A remote attacker can submit specially crafted input to cause match-limit errors to be treated as successful evaluation with no match, leaving the PCRE-limit indicators unset and bypassing rules that depend on those indicators to block incomplete inspection.
Affected software
ModSecurity
How to mitigate CVE-2026-103932
Install security update from vendor's website.
ModSecurity - update to 3.0.17