Hi Salvatore, thank you for opening this issue. I've been planning to make new packages soon (probably today or tomorrow at least), but I hadn't have enough time since the new releases. (Note, that there are two affected packages: modsecurity and modsecurity-apache. The first one has 8 issues, the second one has 6 from those 8.)
Regarding to the new packages: a few issues above (as you listed them) don't have CVE ID's, only Github advisories. The reason is simple: we requested CVE ID's through GH months ago, but still haven't got them (for one, we received that yesterday). What should I put into the d/changelog in these case? The advisory ID is enough? Or should I put this issue ID? Or will you open a DSA (or more?) Thank you, a. On Thu, Oct 01, 2026 at 11:32:15PM +0200, Salvatore Bonaccorso wrote: > Source: modsecurity > Version: 3.0.16-1 > Severity: important > Tags: upstream > X-Debbugs-Cc: [email protected] > > Hi, > > The following vulnerabilities were published for modsecurity. > > CVE-2026-61812[0]: > | GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to evasion > > > CVE-2026-61813[1]: > | GHSA-2vqc-36qp-ccmw: Weak libcurl TLS hostname verification setting > | when fetching over HTTPS > > > CVE-2026-73856[2]: > | GHSA-vmg8-j66p-vgvw: Response body inspection bypass via non-canonical > | Content-Type casing > > > CVE-2026-73857[3]: > | GHSA-jx3r-phvx-2jmj: XML request body processor dereferences an > | uninitialized parser context pointer > > And there are four more issues which have not yet CVEs assigned, they > originate from [4]. > > > If you fix the vulnerabilities please also make sure to include the > CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. > > For further information see: > > [0] https://security-tracker.debian.org/tracker/CVE-2026-61812 > https://www.cve.org/CVERecord?id=CVE-2026-61812 > [1] https://security-tracker.debian.org/tracker/CVE-2026-61813 > https://www.cve.org/CVERecord?id=CVE-2026-61813 > [2] https://security-tracker.debian.org/tracker/CVE-2026-73856 > https://www.cve.org/CVERecord?id=CVE-2026-73856 > [3] https://security-tracker.debian.org/tracker/CVE-2026-73857 > https://www.cve.org/CVERecord?id=CVE-2026-73857 > [4] > https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/ > > Regards, > Salvatore
