CVE-2026-61812— ModSecurity: HTML decoder missing entities, leading to evasion

Quick assessment

Affected

owasp-modsecurity ModSecurity

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ModSecurity 是一个开源、跨平台的 Web 应用防火墙（WAF）引擎，适用于 Apache、IIS 和 Nginx。在 2.9.15 和 3.0.17 版本之前，转换仅能识别一小部分命名 HTML 实体，导致依赖该转换的规则所检查的字节内容与浏览器或后端实际解析的内容不一致。攻击者可以利用未处理的实体名称（包括别名）对 ASCII 分隔符和运算符进行编码，从而绕过依赖该转换的规则。此外，v3 版本的解码器还接受前缀匹配，而非要求实体标记长度完全精确，这使得无效的更长名称也能被转换为不同的字节。该问题已在

CVSS 6.3 · Medium Updated Nov 10, 2026

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ModSecurity: HTML decoder missing entities, leading to evasion

Source: CVE Program / CVE List V5

Vulnerability Description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, t:htmlEntityDecode recognizes only a small subset of named HTML entities, so rules that depend on the transformation can inspect different bytes than a browser or backend. Attackers can encode ASCII separators and operators with unhandled entity names, including aliases, to bypass rules that depend on the transformation. The v3 decoder also accepts prefix matches instead of requiring an exact entity-token length, which can transform invalid longer names into different bytes. This issue is fixed in versions 2.9.15 and 3.0.17.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

编码错误

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
owasp-modsecurity	ModSecurity	< 2.9.15	-

II. Public POCs for CVE-2026-61812

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-61812

请登录查看更多情报信息。

Other References for CVE-2026-61812 (5)

https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17 x_refsource_MISC
https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15 x_refsource_MISC
https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-cxqf-vgrr-xxrv x_refsource_CONFIRM
https://github.com/owasp-modsecurity/ModSecurity/commit/6353be7b09ff222d29a7491c26307d293b00d56f x_refsource_MISC
https://github.com/owasp-modsecurity/ModSecurity/commit/77be8039d734d36ec291d8fbda9e69326ae44755 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-61812

Same Patch Batch · owasp-modsecurity · 2026-11-09 · 3 CVEs total

CVE-2026-73857	7.5 HIGH	ModSecurity v3 XML Request Body Processor Uninitialized Pointer Dereference Vulnerability
CVE-2026-104259	5.4 MEDIUM	ModSecurity: removeComments Transformation Fails to Strip Adjacent Comments, Enabling WAF

IV. Related Vulnerabilities

Same product: ModSecurity

Same vendor: owasp-modsecurity

Same weakness: CWE-172