CVE-2026-61813

Name	CVE-2026-61813
Description	ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOST to 1 instead of the strict value 2L. Under adversary-in-the-middle and TLS interception conditions, this non-strict setting may weaken TLS peer identity validation and increase the risk of accepting a certificate for an unintended host. End-to-end exploitation is non-trivial in typical environments. This issue is fixed in versions 2.9.15 and 3.0.17.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1149651, 1149714

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
modsecurity (PTS)	bookworm	3.0.9-1+deb12u2	vulnerable
	trixie	3.0.14-1+deb13u1	vulnerable
	forky, sid	3.0.16-1	vulnerable
modsecurity-apache (PTS)	bookworm	2.9.7-1+deb12u2	vulnerable
	bookworm (security)	2.9.7-1+deb12u1	vulnerable
	trixie	2.9.11-1+deb13u1	vulnerable
	forky, sid	2.9.13-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
modsecurity	source	(unstable)	(unfixed)			1149651
modsecurity-apache	source	(unstable)	(unfixed)			1149714

Notes

https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-2vqc-36qp-ccmw
https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/