The flaw in ModSecurity’s PCRE2 @rxGlobal causes match‑limit errors to be silently treated as no match instead of reporting failure. When an attacker supplies input that exceeds SecPcreMatchLimit, rules that depend on the limit‑exceeded indicator are skipped, letting a request that should be blocked pass through the WAF. This compromises the integrity and availability of the protected web application.

OWASP ModSecurity version 3.0.5 through 3.0.17 deployed on Apache, IIS, or Nginx. All builds that use the PCRE2 @rxGlobal operator with a limit‑exhaustible expression are affected.

The CVSS score of 5.8 reflects moderate severity. The EPSS score is unknown, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it remotely by sending crafted HTTP requests that trigger the match‑limit, thereby bypassing WAF rules. Escalation of privilege or data exposure depends on the application logic that follows the bypass.