Web Application Firewall Vulnerability in ModSecurity by OWASP
CVE-2026-61812
What is CVE-2026-61812?
ModSecurity, an open-source web application firewall, has a vulnerability that affects its ability to accurately decode HTML entities. Prior to version 2.9.15 and 3.0.17, the function t:htmlEntityDecode was limited to recognizing only a small set of named HTML entities. This vulnerability allows attackers to encode certain ASCII separators and operators with unhandled entity names. As a result, they can potentially bypass security rules that rely on accurate decoding. The decoder in version 3 also permits prefix matches, which can transform invalid names into different byte representations, further complicating detection. It is crucial for users to upgrade to the fixed versions to mitigate this risk.
Affected Version(s)
ModSecurity < 2.9.15 < 2.9.15
ModSecurity >= 3.0.0, < 3.0.17 < 3.0.0, 3.0.17