owasp-modsecurity / owasp-modsecurity/ModSecurity

Stack overflow in pcre.dll

Open
#3,436 10 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

2.x
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

Describe the bug

Log Name:      Application
Source:        Application Error
Date:          20/08/2025 7:23:13 PM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      dev.synrg.com.au
Description:
Faulting application name: w3wp.exe, version: 10.0.17763.1, time stamp: 0xcfdb13d8
Faulting module name: pcre.dll, version: 0.0.0.0, time stamp: 0x6853c858
Exception code: 0xc00000fd
Fault offset: 0x000000000001102e
Faulting process id: 0xa38
Faulting application start time: 0x01dc11b408a9a638
Faulting application path: c:\windows\system32\inetsrv\w3wp.exe
Faulting module path: C:\Program Files\IIS\ModSecurity\pcre.dll
Report Id: 1a12a21f-9522-430e-be5a-427c0732b1db
Faulting package full name: 
Faulting package-relative application ID: 

Logs and dumps

Stack overflow exception
Image

Call stack
Image

PCRE version: 8.45

To Reproduce

Log in to Umbarco Backoffice:
https://example.com/umbraco.

Expected behavior

There are no Application errors.

Server (please complete the following information):

  • ModSecurity version (and connector): ModSecurity v2.9.12
  • WebServer: IIS
  • OS (and distro): Windows

Rule Set (please complete the following information):
OWASP CRS 4.14.0

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the supplied Windows event log and call-stack images for the pcre.dll failure in the IIS worker, noting the reported PCRE 8.45, ModSecurity 2.9.12, and OWASP CRS 4.14.0 versions. Reproduce through the Umbraco Backoffice URL and identify the request or rule that causes the stack overflow; done means the application no longer reports the overflow.

Written by the indexing model from the issue text.

Assessment

Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.