DEBIAN-CVE-2026-61813

    Dashboard / Vulnerabilities / DEBIAN-CVE-2026-61813

    DEBIAN-CVE-2026-61813

    Published: 5 Nov 2026Last Modified: 6 Nov 2026
    Upstream:
    CVE-2026-61813

    Summary:

    Details: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOST to 1 instead of the strict value 2L. Under adversary-in-the-middle and TLS interception conditions, this non-strict setting may weaken TLS peer identity validation and increase the risk of accepting a certificate for an unintended host. End-to-end exploitation is non-trivial in typical environments. This issue is fixed in versions 2.9.15 and 3.0.17.

    References: https://security-tracker.debian.org/tracker/CVE-2026-61813

    Affected packages

    Package

    Name: modsecurity

    Purl: pkg:deb/debian/modsecurity?arch=source&distro=bookworm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    3.0.10-1
    3.0.11-1
    3.0.12-1
    3.0.12-1.1
    3.0.12-1.1~exp1
    3.0.13-1
    3.0.14-1
    3.0.15-1
    3.0.16-1
    3.0.9-1
    3.0.9-1+deb12u1
    3.0.9-1+deb12u2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DEBIAN-CVE-2026-61813 | CVE-DB