Potential regex compilation failure or mismatch with variable-length lookbehind in PCRE patterns

[Yxuan18]

Summary
I am experiencing issues when using regular expressions containing variable-length lookbehind assertions (e.g., (?<!.(?:target|origin).{0,20})\bhaving\b) in ModSecurity v3. The pattern fails to match as expected, likely due to limitations in the underlying PCRE library integration or configuration within src/utils/regex.cc.

Steps to Reproduce
Create a SecRule using a variable-length lookbehind:

SecRule ARGS "@rx (?<!.(?:target|origin).{0,20})\bhaving\b" "id:12345,phase:2,deny,status:403"
Send a request with a payload that should match (e.g., ?data=select having count).

Observe that the rule is not triggered.

Actual Behavior
The regex fails to match the input. In some environments, no explicit compilation error is shown in the debug log, leading to "silent failure" where the rule is simply ignored.

Expected Behavior
The regex should either:

Match the input if the linked PCRE library (PCRE2 10.30+) supports variable-length lookbehind.

Provide a clear compilation error in the ModSecurity log indicating that the pattern is unsupported by the current PCRE version.

Technical Context
Looking at src/utils/regex.cc, ModSecurity wraps PCRE/PCRE2. However:

Most PCRE1 versions (still common in many distros) strictly forbid non-fixed-width lookbehind (errors like lookbehind assertion is not fixed length).

If ModSecurity is compiled with PCRE2, it should theoretically support this, but the implementation may not be passing the necessary JIT or match options to handle complex lookbehind depth.

[airween]

SecRule ARGS "@rx (?<!.(?:target|origin).{0,20})\bhaving\b" "id:12345,phase:2,deny,status:403" 

Send a request with a payload that should match (e.g., ?data=select having count).

Observe that the rule is not triggered.

Are you sure? I copied this rule and checked your request and it definitely triggered.

Here is the config (I put the rule with a different rule ID):

SecRule ARGS "@rx (?<!.(?:target|origin).{0,20})\bhaving\b" "id:12345678,phase:2,deny,status:403"

add sent the request:

curl -v -X POST http://localhost:8080/ -d "data=select having count"

and this is what I get in my error.log:

2026/04/07 20:02:16 [info] 8135#8135: *1 ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?<!.(?:target|origin).{0,20})\bhaving\b' against variable `ARGS:data' (Value: `select having count' ) [file "/home/airween/src/coreruleset/owasp-crs.load"] [line "26"] [id "12345678"] [rev ""] [msg ""] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "localhost"] [uri "/"] [unique_id "177558493696.780756"] [ref "o7,6v146,19"], client: ::1, server: _, request: "POST / HTTP/1.1", host: "localhost:8080"

in debug.log:

 (Rule: 12345678) Executing operator "Rx" with param "(?<!.(?:target|origin).{0,20})\bhaving\b" against ARGS.
 Target value: "select having count" (Variable: ARGS:data)
 Matched vars updated.
 Rule returned 1.

Could you check your result again?

Match the input if the linked PCRE library (PCRE2 10.30+) supports variable-length lookbehind.

This is what I have:

$ ldd /usr/lib/libmodsecurity.so.3
        ...
	libpcre2-8.so.0 => /lib/x86_64-linux-gnu/libpcre2-8.so.0 (0x00007f5f45ad9000)