Web Application Firewall Vulnerability in ModSecurity
CVE-2026-61813

3.7LOW

Key Information:

Vendor

Owasp-modsecurity

Status
Modsecurity
Vendor
CVE Published:
5 November 2026

What is CVE-2026-61813?

ModSecurity, a widely-used open-source Web Application Firewall (WAF), was found to have a vulnerability in its HttpsClient::download function, affecting versions prior to 2.9.15 and 3.0.17. The mechanism used for verifying SSL certificates was set to a non-strict mode, which can lead to weak TLS peer identity validation. This may potentially allow an attacker to intercept TLS communications and accept certificates for unintended hosts, increasing susceptibility to 'man-in-the-middle' attacks. It is recommended to update to the fixed versions to ensure robust TLS security.

Affected Version(s)

ModSecurity < 2.9.15 < 2.9.15

ModSecurity >= 3.0.0, < 3.0.17 < 3.0.0, 3.0.17

References

https://github.com/owasp-modsecurity/ModSecurity/security...
x_refsource_CONFIRM
https://github.com/owasp-modsecurity/ModSecurity/commit/c...
x_refsource_MISC
https://github.com/owasp-modsecurity/ModSecurity/commit/e...
x_refsource_MISC

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.