ModSecurity's t:removeComments transformation can be bypassed because it mishandles the character following a comment terminator, letting crafted input evade rules that rely on this normalization step. The issue affects ModSecurity deployments whose rulesets invoke t:removeComments, such as configurations derived from the OWASP Core Rule Set, with real impact only when an exploitable downstream sink (for example SQL injection, XSS, or command injection) was otherwise blocked by the bypassed rule. No public exploit identified at time of analysis; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating low integrity impact with no confidentiality or availability impact.
Improper error handling in the @rxGlobal component's PCRE2 integration allows a match-limit error returned by the regex engine to be misinterpreted as a successful match (fail-open), so any application that uses an @rxGlobal regex result as a security decision - an allow/deny filter, an input validator, or an authorization pattern - can have that control bypassed by an unauthenticated remote attacker who supplies input expensive enough to exhaust PCRE2's match limit. The same error-handling path does not safely reject invalid patterns, so a malformed pattern reaching the engine can crash the process handling the request. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L: exploitation is network-reachable and unauthenticated, but the high attack complexity and the strictly conditional, low integrity and availability impact reflect that the flaw only matters where the regex result drives a security decision and that the attacker must first defeat match-limit tuning. No public exploit code has been identified at time of analysis, and exact affected versions were not confirmed from the available data.