CVE-2026-61619

Name of the Vulnerable Software and Affected Versions OWASP Core Rule Set versions prior to 3.3.10 OWASP Core Rule Set versions prior to 4.25.1 OWASP Core Rule Set versions prior to 4.28.0

Description A regular-expression denial of service (ReDoS) exists in a shared regex-assembly include used for 12 Unix RCE detection rules in version 4 and within 4 rules in version 3.3. An unauthenticated attacker can send a single crafted request that causes PCRE2 to exceed its backtracking limit. This leads to the @rx operator returning an error instead of a match result, resulting in a CPU denial of service and a detection bypass.

Recommendations Update to version 3.3.10 or later. Update to version 4.25.1 or later. Update to version 4.28.0 or later.