Source: modsecurity Version: 3.0.16-1 Severity: important Tags: upstream X-Debbugs-Cc: [email protected]
Hi, The following vulnerabilities were published for modsecurity. CVE-2026-61812[0]: | GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to evasion CVE-2026-61813[1]: | GHSA-2vqc-36qp-ccmw: Weak libcurl TLS hostname verification setting | when fetching over HTTPS CVE-2026-73856[2]: | GHSA-vmg8-j66p-vgvw: Response body inspection bypass via non-canonical | Content-Type casing CVE-2026-73857[3]: | GHSA-jx3r-phvx-2jmj: XML request body processor dereferences an | uninitialized parser context pointer And there are four more issues which have not yet CVEs assigned, they originate from [4]. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-61812 https://www.cve.org/CVERecord?id=CVE-2026-61812 [1] https://security-tracker.debian.org/tracker/CVE-2026-61813 https://www.cve.org/CVERecord?id=CVE-2026-61813 [2] https://security-tracker.debian.org/tracker/CVE-2026-73856 https://www.cve.org/CVERecord?id=CVE-2026-73856 [3] https://security-tracker.debian.org/tracker/CVE-2026-73857 https://www.cve.org/CVERecord?id=CVE-2026-73857 [4] https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/ Regards, Salvatore
