diff --git a/doc/modsecurity2-apache-reference.xml b/doc/modsecurity2-apache-reference.xml
index a5e3b047..f3ba970f 100644
--- a/doc/modsecurity2-apache-reference.xml
+++ b/doc/modsecurity2-apache-reference.xml
@@ -1484,12 +1484,27 @@ SecMarker 99
Version: 2.5.12
Dependencies/Notes: Default is set at compile
- (1500 by default)
+ (1500 by default). See also
+ SecPcreMatchLimitRecursion
- The --enable-pcre-match-limit=val configure
- option will set a custom default and the
- --disable-pcre-match-limit option will resort to the
- compiled PCRE library default.
+ If the limits are exceeded this will be logged at level 3 in the
+ debug log, added as a Message line in the audit log and the TX:MSC_PCRE_LIMITS_EXCEEDED flag will be set
+ to a non-zero value. To prevent bypass, you should write a rule to check
+ for the existance of the TX:MSC_PCRE_LIMITS_EXCEEDED flag.
+
+ SecPcreMatchLimit 100
+SecPcreMatchLimitRecursion 100
+ ...
+SecRule TX:/^MSC_/ "!@eq 0" "phase:5,pass,log,auditlog,msg:'Potential REDoS'"
+
+
+ The --enable-pcre-match-limit=val configure
+ option will set a custom default and the
+ --disable-pcre-match-limit option will resort to
+ the compiled PCRE library default.
+
@@ -1512,12 +1527,26 @@ SecMarker 99
Version: 2.5.12
Dependencies/Notes: Default is set at compile
- (1500 by default)
+ (1500 by default). See also SecPcreMatchLimit
- The --enable-pcre-match-limit-recursion=val
- configure option will set a custom default and the
- --disable-pcre-match-limit-recursion option will
- resort to the compiled PCRE library default.
+ If the limits are exceeded this will be logged at level 3 in the
+ debug log, added as a Message line in the audit log and the TX:MSC_PCRE_LIMITS_EXCEEDED flag will be set
+ to a non-zero value. To prevent bypass, you should write a rule to check
+ for the existance of the TX:MSC_PCRE_LIMITS_EXCEEDED flag.
+
+ SecPcreMatchLimit 100
+SecPcreMatchLimitRecursion 100
+ ...
+SecRule TX:/^MSC_/ "!@eq 0" "phase:5,pass,log,auditlog,msg:'Potential REDoS'"
+
+
+ The --enable-pcre-match-limit-recursion=val
+ configure option will set a custom default and the
+ --disable-pcre-match-limit-recursion option will
+ resort to the compiled PCRE library default.
+
@@ -3930,7 +3959,7 @@ SecAction setsid:%{REQUEST_COOKIES.PHPSESSID}
- TX:MSC_.* - ModSecurity
+ TX:MSC_* - ModSecurity
processing flags.