@ipMatchFromFile and @ipMatch code (same code in v2 & v3) becomes buggy from a certain number of IP.

2192#issuecomment-2585947641

We are running Ubuntu Server 22.04.5 LTS. ModSecurity was installed using apt from the repo for this server version.

ModSecurity-nginx v1.0.4
libmodsecurity3 version 3.0.15

I will pull the information for you. I enabled SecDebugLog and initiated a remote security scan. Here's the startup message I see in /var/log/apache2/error.log (not sure if this is helpful).

[Sun Jan 12 22:10:36.887513 2025] [mpm_prefork:notice] [pid 34180] AH00170: caught SIGWINCH, shutting down gracefully
[Sun Jan 12 22:10:37.217509 2025] [:notice] [pid 34576] ModSecurity for Apache/2.9.5 (http://www.modsecurity.org/) configured.
[Sun Jan 12 22:10:37.218306 2025] [:notice] [pid 34576] ModSecurity: APR compiled version="1.7.0"; loaded version="1.7.0"
[Sun Jan 12 22:10:37.218320 2025] [:notice] [pid 34576] ModSecurity: PCRE compiled version="8.39 "; loaded version="8.45 2021-06-15"
[Sun Jan 12 22:10:37.218326 2025] [:warn] [pid 34576] ModSecurity: Loaded PCRE do not match with compiled!
[Sun Jan 12 22:10:37.218331 2025] [:notice] [pid 34576] ModSecurity: LUA compiled version="Lua 5.1"
[Sun Jan 12 22:10:37.218336 2025] [:notice] [pid 34576] ModSecurity: YAJL compiled version="2.1.0"
[Sun Jan 12 22:10:37.218341 2025] [:notice] [pid 34576] ModSecurity: LIBXML compiled version="2.9.13"
[Sun Jan 12 22:10:37.218345 2025] [:notice] [pid 34576] ModSecurity: Status engine is currently disabled, enable it by set SecStatusEngine to On.
[Sun Jan 12 22:10:37.410683 2025] [mpm_prefork:notice] [pid 34577] AH00163: Apache/2.4.52 (Ubuntu) OpenSSL/3.0.2 configured -- resuming normal operations
[Sun Jan 12 22:10:37.412740 2025] [core:notice] [pid 34577] AH00094: Command line: '/usr/sbin/apache2'

Start with the linked issue comment and reproduce the behavior using @ipMatchFromFile and @ipMatch with the reported Ubuntu, ModSecurity-nginx, libmodsecurity, and Apache versions. Narrow down the IP-count threshold and affected directive behavior; done means the failure is reproducible, its expected behavior is established, and the regression is covered by the project's relevant tests.