Modsecurity Execution error - PCRE limits exceeded (-47)

[imorandin]

Hi,

We're occasionally seeing the following errors in the Apache error_log:

[Wed Dec 03 11:32:52.775133 2025] [security2:error] [pid 2737351:tid 2737351] [client 186.22.19.226:0] ModSecurity: Rule 563f521ffeb8 [id "-"][file "/etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/013_i360_generic.conf"][line "118"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "xxxx.com.ar"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aTBKFD70y_vck7R3WBthfAAAAAg"], referer: [URL]http://xxxxx.com.ar/wp-admin/post-new.php[/URL]

From what I understand, this is caused by PCRE limits being hit when ModSecurity processes certain requests.
I assume we need to increase the following directives, but I’m not sure what values are recommended in this case:

• SecPcreMatchLimit
• SecPcreMatchLimitRecursion

Could you advise what values we should use, or if there’s a preferred approach to handle this type of error?

Thanks,
Ignacio

[akots]

Hi Ignacio,

The errors you shared are caused by the content that the rules are inspecting. In certain cases, the inspected content may be so complex that ModSecurity stops itself from "doing too much work".

You may have to add these limits with the following values:

SecPcreMatchLimit 25000
SecPcreMatchLimitRecursion 25000

or increase these limits for your system if you continue to get PCRE limit errors.