CVE-2019-11389

CVE-2019-11389 describes a Regular Expression Denial of Service (ReDOS) vulnerability in OWASP ModSecurity Core Rule Set (CRS) versions up to 3.1.0, specifically within the /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf file. An unauthenticated attacker could trigger this by submitting a specially crafted string, leading to a denial of service. While rated Medium severity with a CVSS score of 5.3, the maintainer disputes it as a vulnerability due to ModSecurity's inability to exploit it. There is no known active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.