Owasp Modsecurity Core Rule Set

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:modsecurity:owasp_modsecurity_core_rule_set:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorModsecurity (9a6f8313-3c99-512d-a837-0407e4fd79ad)
ProductOwasp Modsecurity Core Rule Set (8b86a914-5dfc-5758-86a8-e4fd98caf6b6)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/coreruleset/coreruleset purl2cpe 2026-06-01 10:15:33.509530

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2019-11391 vulnerable 2026-06-08 05:12:37.104769 Details available
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with $a# at the beginning and nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity
Published: 2019-04-21T01:16:16.000Z
Updated: 2024-08-04T22:55:39.343Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-11390 vulnerable 2026-06-08 05:12:37.104391 Details available
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with set_error_handler# at the beginning and nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity
Published: 2019-04-21T01:16:04.000Z
Updated: 2024-08-04T22:48:09.220Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-11389 vulnerable 2026-06-08 05:12:37.104074 Details available
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with next# at the beginning and nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity
Published: 2019-04-21T01:15:45.000Z
Updated: 2024-08-04T22:48:09.112Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-11388 vulnerable 2026-06-08 05:12:37.103732 Details available
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity
Published: 2019-04-21T01:15:03.000Z
Updated: 2024-08-28T13:17:14.055Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-11387 vulnerable 2026-06-08 05:12:37.103119 Details available
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with nested repetition operators.
Published: 2019-04-21T01:14:49.000Z
Updated: 2024-08-04T22:48:09.171Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.