CVE-2026-61619

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls.

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service (ReDoS) affects a shared regex-assembly include used to build 12 Unix RCE detection rules in CRS v4, and the same ambiguous pattern was present in the manually-assembled regexes in 4 rules in CRS v3.3. With a single, unauthenticated, crafted request, the generated pattern…

11. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-61619