Is CVE-2026-61619 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61619 being exploited in the wild.

How severe is CVE-2026-61619?

Informational severity, published 11 November 2026.

Which products and versions are affected?

OWASP Core Rule Set before 3.3.10, 4.x before 4.25.1, 4.x before 4.28.0.

Is there a fix for CVE-2026-61619?

Yes: fixed in 3.3.10, 4.25.1, 4.28.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61619 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-61619?

Check whether you run OWASP Core Rule Set at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61619: OWASP Core Rule Set ReDoS in regex detection rules

CVE-2026-61619 · Severity: info · Published 2026-11-11

The OWASP Core Rule Set provides attack detection rules for web application firewalls to block malicious traffic. A regular-expression denial of service flaw in the ruleset's pattern matching allows attackers to craft a single HTTP request that causes excessive CPU consumption and bypasses RCE detection rules. This permits remote code execution attempts to evade the firewall with no authentication required.

Technologies: OWASP Core Rule Set. Vendors: OWASP.

Quick answers

Is CVE-2026-61619 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61619 being exploited in the wild.
How severe is CVE-2026-61619?: Informational severity, published 11 November 2026.
Which products and versions are affected?: OWASP Core Rule Set before 3.3.10, 4.x before 4.25.1, 4.x before 4.28.0.
Is there a fix for CVE-2026-61619?: Yes: fixed in 3.3.10, 4.25.1, 4.28.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61619 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-61619?: Check whether you run OWASP Core Rule Set at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.3.10, 4.25.1, 4.28.0

Technical details

Regular-expression denial of service (ReDoS) in shared regex patterns used by 12 Unix RCE detection rules in CRS v4 (and 4 manually-assembled rules in v3.3), caused by ambiguous alternation with overlapping whitespace quantifiers that trigger exponential backtracking in PCRE2. An unauthenticated attacker sends a crafted request that forces the regex engine past its backtracking limit, causing the @rx operator to return an error instead of a match, allowing bypass of detection. Fixed by rewriting pattern branches to consume whitespace in exactly one location per token.

Affected products

OWASP Core Rule Set before 3.3.10, 4.x before 4.25.1, 4.x before 4.28.0

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.