# CVE-2026-61619: OWASP Core Rule Set ReDoS in regex detection rules

Source: https://junglewise.ai/threats/cve-2026-61619-the-owasp-core-rule-set-crs-is-a-set-of-generic-attack-detection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-61619 · Severity: info · Published 2026-11-11

The OWASP Core Rule Set provides attack detection rules for web application firewalls to block malicious traffic. A regular-expression denial of service flaw in the ruleset's pattern matching allows attackers to craft a single HTTP request that causes excessive CPU consumption and bypasses RCE detection rules. This permits remote code execution attempts to evade the firewall with no authentication required.

Technologies: [OWASP Core Rule Set](https://junglewise.ai/threats/technologies/core-rule-set). Vendors: [OWASP](https://junglewise.ai/threats/vendors/owasp).

## Quick answers

**Is CVE-2026-61619 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61619 being exploited in the wild.

**How severe is CVE-2026-61619?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** OWASP Core Rule Set before 3.3.10, 4.x before 4.25.1, 4.x before 4.28.0.

**Is there a fix for CVE-2026-61619?** Yes: fixed in 3.3.10, 4.25.1, 4.28.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61619 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61619?** Check whether you run OWASP Core Rule Set at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.3.10, 4.25.1, 4.28.0

## Technical details

Regular-expression denial of service (ReDoS) in shared regex patterns used by 12 Unix RCE detection rules in CRS v4 (and 4 manually-assembled rules in v3.3), caused by ambiguous alternation with overlapping whitespace quantifiers that trigger exponential backtracking in PCRE2. An unauthenticated attacker sends a crafted request that forces the regex engine past its backtracking limit, causing the @rx operator to return an error instead of a match, allowing bypass of detection. Fixed by rewriting pattern branches to consume whitespace in exactly one location per token.

## Affected products

- OWASP Core Rule Set before 3.3.10, 4.x before 4.25.1, 4.x before 4.28.0

## Timeline

- 2026-11-11: disclosed

## References

- [https://github.com/coreruleset/coreruleset/commit/4665b6d7a79a81aa8a802ef3c901d69491c009a4](https://github.com/coreruleset/coreruleset/commit/4665b6d7a79a81aa8a802ef3c901d69491c009a4)
- [https://github.com/coreruleset/coreruleset/commit/6083611d00291e85ab7b587e96577deb53ed9cac](https://github.com/coreruleset/coreruleset/commit/6083611d00291e85ab7b587e96577deb53ed9cac)

## Related threats

- [OWASP Core Rule Set XML attribute bypass in attack detection](https://junglewise.ai/threats/cve-2026-62971-the-owasp-core-rule-set-crs-is-a-set-of-generic-attack-detection)
- [OWASP Core Rule Set bypass via filename whitespace padding](https://junglewise.ai/threats/cve-2026-33691-owasp-core-rule-set-bypass-via-filename-whitespace-padding)