CVE-2019-11390

CVE-2019-11390 describes a Regular Expression Denial of Service (ReDOS) vulnerability in OWASP ModSecurity Core Rule Set (CRS) through version 3.1.0, specifically within the REQUEST-933-APPLICATION-ATTACK-PHP.conf file. An unauthenticated attacker could trigger this by submitting a specially crafted string, potentially causing a denial of service. While rated Medium severity (CVSS 5.3) with low attack complexity and no user interaction required, the software maintainer disputes it as a vulnerability due to the inability to exploit it via ModSecurity itself. There is no known active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.