CVE-2026-61813
ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOST to 1 instead of the strict value 2L. Under adversary-in-the-middle and TLS interception conditions, this non-strict setting may weaken TLS peer identity validation and increase the risk of accepting a certificate for an unintended host. End-to-end exploitation is non-trivial in typical environments. This issue is fixed in versions 2.9.15 and 3.0.17.
| CWE | CWE-295 |
| Vendor | owasp-modsecurity |
| Product | modsecurity |
| Published | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for owasp-modsecurity modsecurity
Be the first to know when new low vulnerabilities affecting owasp-modsecurity modsecurity are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
owasp-modsecurity / ModSecurity
< 2.9.15 >= 3.0.0, < 3.0.17
References
github.com: https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-2vqc-36qp-ccmw github.com: https://github.com/owasp-modsecurity/ModSecurity/commit/cce204806430e4848327aadeb9113e654631a0c1 github.com: https://github.com/owasp-modsecurity/ModSecurity/commit/edca70d853bfb725325137fa40d178beebc324fc github.com: https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15 github.com: https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17