owasp-modsecurity / owasp-modsecurity/ModSecurity
Stack overflow in pcre.dll
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Describe the bug
Log Name: Application
Source: Application Error
Date: 20/08/2025 7:23:13 PM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: dev.synrg.com.au
Description:
Faulting application name: w3wp.exe, version: 10.0.17763.1, time stamp: 0xcfdb13d8
Faulting module name: pcre.dll, version: 0.0.0.0, time stamp: 0x6853c858
Exception code: 0xc00000fd
Fault offset: 0x000000000001102e
Faulting process id: 0xa38
Faulting application start time: 0x01dc11b408a9a638
Faulting application path: c:\windows\system32\inetsrv\w3wp.exe
Faulting module path: C:\Program Files\IIS\ModSecurity\pcre.dll
Report Id: 1a12a21f-9522-430e-be5a-427c0732b1db
Faulting package full name:
Faulting package-relative application ID:
Logs and dumps
Stack overflow exception
Call stack
PCRE version: 8.45
To Reproduce
Log in to Umbarco Backoffice:
https://example.com/umbraco.
Expected behavior
There are no Application errors.
Server (please complete the following information):
- ModSecurity version (and connector): ModSecurity v2.9.12
- WebServer: IIS
- OS (and distro): Windows
Rule Set (please complete the following information):
OWASP CRS 4.14.0
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the supplied Windows event log and call-stack images for the pcre.dll failure in the IIS worker, noting the reported PCRE 8.45, ModSecurity 2.9.12, and OWASP CRS 4.14.0 versions. Reproduce through the Umbraco Backoffice URL and identify the request or rule that causes the stack overflow; done means the application no longer reports the overflow.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100