| Release | Version |
|---|---|
| bookworm | 2.9.7-1+deb12u2 |
| bookworm (security) | 2.9.7-1+deb12u1 |
| trixie | 2.9.11-1+deb13u1 |
| forky | 2.9.13-1 |
| sid | 2.9.13-1 |
| Bug | bookworm | trixie | forky | sid | Description |
|---|---|---|---|---|---|
| TEMP-1149651-E1250D | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-4j47-8qcr-jf59: t:base64DecodeExt does not decode - and _, bypassing rules on URL-safe encoded payloads |
| CVE-2026-104269 | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-5pww-8rfg-9crf: RFC 2231 filename* parameter bypasses multipart filename rules |
| CVE-2026-104259 | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-qrch-pjfr-9g47: t:removeComments mishandles the character after a comment terminator, bypassing rules |
| CVE-2026-61813 | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-2vqc-36qp-ccmw: Weak libcurl TLS hostname verification setting when fetching over HTTPS |
| CVE-2026-61812 | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to evasion |
| Bug | Description |
|---|---|
| CVE-2025-54571 | ModSecurity is an open source, cross platform web application firewall ... |
| CVE-2025-52891 | ModSecurity is an open source, cross platform web application firewall ... |
| CVE-2025-48866 | ModSecurity is an open source, cross platform web application firewall ... |
| CVE-2025-47947 | ModSecurity is an open source, cross platform web application firewall ... |
| CVE-2023-24021 | Incorrect handling of '\0' bytes in file uploads in ModSecurity before ... |
| CVE-2022-48279 | In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart reque ... |
| CVE-2021-42717 | ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objec ... |
| CVE-2013-5705 | apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attack ... |
| CVE-2013-2765 | The ModSecurity module before 2.7.4 for the Apache HTTP Server allows ... |
| CVE-2013-1915 | ModSecurity before 2.7.3 allows remote attackers to read arbitrary fil ... |
| CVE-2012-4528 | The mod_security2 module before 2.7.0 for the Apache HTTP Server allow ... |
| CVE-2012-2751 | ModSecurity before 2.6.6, when used with PHP, does not properly handle ... |
| CVE-2009-5031 | ModSecurity before 2.5.11 treats request parameter values containing s ... |
| DSA / DLA | Description |
|---|---|
| DLA-4294-1 | modsecurity-apache - security update |
| DLA-4212-1 | modsecurity-apache - security update |
| DSA-5940-1 | modsecurity-apache - security update |
| DLA-4192-1 | modsecurity-apache - security update |
| DLA-3283-1 | modsecurity-apache - security update |
| DLA-3031-1 | modsecurity-apache - security update |
| DSA-5023-1 | modsecurity-apache - security update |
| DSA-2991-1 | modsecurity-apache - security update |