WAF error "Execution error - PCRE limits exceeded"

Question

Our waf rules are blocking some content from accessing the backend web server; I searched the wag logs and found some OWASAP rules, the associated rule number is 932150, and the normal error message should be Remote Command Execution: Direct Unix Command Execution. However, I am showing Execution error - PCRE limits exceeded. I also searched the following OWASP code link to try to find it, but found nothing https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules?tabs=drs21%2Cowasp30 In addition, I am very new to troubleshooting application gateways and web application firewalls; I would appreciate any learning insights beyond the obvious content on the Microsoft website.

Answer 1

Hello Wesley

We understand that WAF rule 932150 is blocking content from accessing your backend web server, and you’re seeing an "Execution error - PCRE limits exceeded" message instead of the expected "Remote Command Execution: Direct Unix Command Execution" error.

The error you're seeing "Execution error - PCRE limits exceeded" — means that mod_security's regex engine (PCRE) hit internal limits during rule evaluation, often due to large or complex request bodies.

This is also known issue in WAFs using mod_security, particularly when input length or complexity causes a catastrophic backtracking situation in regex evaluation.

Please check the below details for troubleshooting:

1. WAF logs show every request that WAF matches or blocks. If a request is blocked that shouldn't be, narrow down the specific request by looking through the logs for the specific URI, timestamp, or transaction ID https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/web-application-firewall-troubleshoot

Enable and review ApplicationGatewayFirewallLog in Log Analytics or your configured storage account.

• Filter logs for ruleId = 932150 to identify blocked requests. Look for:
  • Client IP: To confirm the source of the request.
  • Request URI: The specific endpoint being blocked.
  • Matched Variable: The part of the request triggering the rule (e.g., ARGS, REQUEST_BODY).
  • Transaction ID: To correlate with backend logs.
  • RuleSetVersion: Confirm whether you’re using OWASP 3.2, DRS 2.1, or another version.
• Example log entry: "message": "Execution error - PCRE limits exceeded" indicates that the regex evaluation failed due to request complexity.

2.Try to analyze the input, the PCRE error is usually caused by large complex request bodies.

3.Test the Request Without WAF like temporarily disable WAF (Detection mode) or route traffic around the WAF to your backend (in a test environment only).

4.Verify that your backend works without the WAF to ensure it’s not an app-side issue.

5.You can create exclusions and custom Rules and even disable rules that may be causing issues or false positives.

https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-customize-waf-rules-portal?source=recommendations

Based on your queries we have shared below details:

You can tune the WAF using below article which discusses how to recognize and mitigate false positives in WAF alerts, ensuring that legitimate traffic is not mistakenly blocked.

https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/azure-waf-tuning-for-web-applications/3776133

https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-tuning?pivots=front-door-standard-premium

After you tune your WAF, you should configure it to run in prevention mode. By running in prevention mode, you ensure the WAF actually blocks requests that it detects as malicious. Running in detection mode is useful for testing purposes while you tune and configure your WAF, but it provides no protection. It logs the traffic, but it doesn't take any actions such as allow or deny.

Reference: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/best-practices#tune-your-waf

---

I hope this helps! Please let me know if you have further questions or need additional guidance.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

Hi Wesley,

Thanks for sharing the details about the WAF error you're encountering. The message "Execution error PCRE limits exceeded" typically occurs when the Web Application Firewall hits a processing limit while evaluating a request with a complex or lengthy pattern. This is related to OWASP rule 932150, which is designed to detect Remote Command Execution attempts, but in your case, the issue is more about regex engine constraints rather than a direct security match.

The error suggests that the Perl Compatible Regular Expressions engine, used by Azure WAF to match patterns, has exceeded its configured limits while processing a request. This can happen with very long query strings, deeply nested payloads, or overly complex input that triggers excessive backtracking in regex evaluation.

First, check the WAF logs in Azure to identify the exact request causing this issue. Look for unusually long parameters, headers, or payloads that might be too resource-intensive for the rule to process. You can use Azure WAF diagnostics (available in the Azure Portal under Diagnose and solve problems) to filter logs for Rule ID 932150 and analyze the problematic traffic.

If the request is legitimate, you have a few options:

• Adjust PCRE limits: Azure WAF allows some tuning of regex processing limits, though this is not always straightforward. You might need to experiment with custom rules or policy adjustments.

Create an exclusion: If this is a false positive, you can exclude the specific request attribute (e.g., a particular URL or parameter) from WAF inspection.

Modify the rule: In some cases, disabling or customizing rule 932150 in a custom rule set can help, but ensure this doesn’t compromise security.

Additional Resources

For deeper insights, check out:

• OWASP Core Rule Set Documentation – Explains the logic behind rule 932150.
• PCRE Limits and Optimization – Technical details on regex processing constraints.

If you’d like, you can share a sanitized version of the blocked request (removing any sensitive data), and I can help analyze the specific pattern causing the issue. Also, let me know if you’re using DRS 2.1/3.0 or a custom rule set, as this might influence the solution.

For immediate mitigation, you could switch the WAF to Detection mode to log but not block requests while troubleshooting. Temporarily disable rule 932150 (if safe) to confirm it’s the root cause.

Let me know how you’d like to proceed

Best regards,
Alex
P.S. If my answer help to you, please Accept my answer
PPS That is my Answer and not a Comment