{"affected":[{"product":"coreruleset","source":"CNA: GitHub_M","vendor":"coreruleset","versions":[{"status":"affected","version":"< 3.3.10"},{"status":"affected","version":"< 4.25.1"},{"status":"affected","version":"< 4.28.0"}]}],"cveId":"CVE-2026-61619","cwes":["CWE-1333"],"description":"The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service (ReDoS) affects a shared regex-assembly include used to build 12 Unix RCE detection rules in CRS v4, and the same ambiguous pattern was present in the manually-assembled regexes in 4 rules in CRS v3.3. With a single, unauthenticated, crafted request, the generated pattern drives PCRE2 past its backtracking limit. When PCRE2 exceeds that limit, the @rx operator returns an error rather than a match result, which results in detection bypass and CPU denial of service. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794418361641,"publishedAt":1794418361641,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/coreruleset/coreruleset/security/advisories/GHSA-f5qm-3h4p-8qhg"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/coreruleset/coreruleset/commit/4665b6d7a79a81aa8a802ef3c901d69491c009a4"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/coreruleset/coreruleset/commit/6083611d00291e85ab7b587e96577deb53ed9cac"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/coreruleset/coreruleset/commit/e3b612a909532dcc8d056c01ac04b31117b71505"}],"remediation":[],"revision":"00dedd6591859daf508d31596f235240ec7c2d278621e78d0260d6d067ae88ba","sources":[{"modifiedAt":1794418361641,"name":"CNA: GitHub_M","retrievedAt":1794421534335,"url":"https://www.cve.org/CVERecord?id=CVE-2026-61619"}],"ssvc":null,"status":"published","title":"OWASP CRS: ReDoS in shared unix-shell-evasion regex-assembly include (12 RCE rules) - PCRE2 backtracking-limit exhaustion causes detection bypass and CPU DoS","updatedAt":1794421534335}