Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-61813— ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download

Quick assessment

Affected

owasp-modsecurity ModSecurity

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ModSecurity 是一款开源、跨平台的 Web 应用防火墙（WAF）引擎，支持 Apache、IIS 和 Nginx。在 2.9.15 和 3.0.17 版本之前，文件中的函数将 libcurl 的选项设置为 1，而非更严格的值 2L。在存在中间人攻击或 TLS 拦截的情况下，这一非严格设置可能削弱对 TLS 对等方身份的验证，从而增加接受非预期主机证书的风险。在典型环境中，实现端到端利用较为困难。该问题已在 2.9.15 和 3.0.17 版本中修复。

CVSS 3.7 · Low EPSS 0.15% · P5 Updated Nov 05, 2026

Possible ATT&CK Techniques 2 AI

T1040 · Network Sniffing T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

Vendor	Product	Version Range	Status
owasp-modsecurity	ModSecurity	`< 2.9.15`	affected
		`>= 3.0.0, < 3.0.17`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download

Source: CVE Program / CVE List V5

Vulnerability Description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOST to 1 instead of the strict value 2L. Under adversary-in-the-middle and TLS interception conditions, this non-strict setting may weaken TLS peer identity validation and increase the risk of accepting a certificate for an unintended host. End-to-end exploitation is non-trivial in typical environments. This issue is fixed in versions 2.9.15 and 3.0.17.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

证书验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
owasp-modsecurity	ModSecurity	< 2.9.15	-

II. Public POCs for CVE-2026-61813

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-61813

请登录查看更多情报信息。

Other References for CVE-2026-61813 (5)

https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17 x_refsource_MISC
https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15 x_refsource_MISC
https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-2vqc-36qp-ccmw x_refsource_CONFIRM
https://github.com/owasp-modsecurity/ModSecurity/commit/cce204806430e4848327aadeb9113e654631a0c1 x_refsource_MISC
https://github.com/owasp-modsecurity/ModSecurity/commit/edca70d853bfb725325137fa40d178beebc324fc x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-61813

Same Patch Batch · owasp-modsecurity · 2026-11-05 · 4 CVEs total

CVE-2026-73856	8.6 HIGH	ModSecurity: Response Body Inspection Bypass
CVE-2026-104269	8.6 HIGH	ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compl
CVE-2026-103932	5.8 MEDIUM	ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match

IV. Related Vulnerabilities

Same product: ModSecurity

Same vendor: owasp-modsecurity

Same weakness: CWE-295