Update: Since the ticket was created, we have received three additional CVE identifiers:
GHSA-5m93-4h75-3p2w -> CVE-2026-103932 GHSA-qrch-pjfr-9g47 -> CVE-2026-104259 GHSA-5pww-8rfg-9crf -> CVE-2026-104269 I'll use CVE ID's in d/changelog where it is possible. Regards, a. On Fri, Oct 02, 2026 at 05:13:43PM +0200, Salvatore Bonaccorso wrote: > Source: modsecurity-apache > Version: 2.9.13-1 > X-Debbugs-CC: [email protected] > Severity: important > Tags: security upstream > > Hi, > > The following vulnerabilities were published for modsecurity-apache. > > CVE-2026-61812[0]: > | GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to evasion > > > CVE-2026-61813[1]: > | GHSA-2vqc-36qp-ccmw: Weak libcurl TLS hostname verification setting > | when fetching over HTTPS > > and there are three more without yet a CVE assigned > (GHSA-5pww-8rfg-9crf, GHSA-qrch-pjfr-9g47, GHSA-4j47-8qcr-jf59) > > If you fix the vulnerabilities please also make sure to include the > CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. > > For further information see: > > [0] https://security-tracker.debian.org/tracker/CVE-2026-61812 > https://www.cve.org/CVERecord?id=CVE-2026-61812 > [1] https://security-tracker.debian.org/tracker/CVE-2026-61813 > https://www.cve.org/CVERecord?id=CVE-2026-61813 > [2] > https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/ > > Please adjust the affected versions in the BTS as needed. > > Regards, > Salvatore
