Read the docs
TI-2026-85487 Aliases CVE-2026-61813

Incorrect TLS hostname verification in ModSecurity HTTPS client

Priority LOW 17CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-295.

Summary

ModSecurity before 2.9.15 and from 3.0.0 before 3.0.17 are affected. The HttpsClient::download function sets libcurl hostname verification to a non-strict value, which is improper certificate validation (CWE-295). Under adversary-in-the-middle or TLS interception conditions, an attacker may get a certificate for an unintended host accepted. The source states that end-to-end exploitation is non-trivial in typical environments.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOST to 1 instead of the strict value 2L. Under adversary-in-the-middle and TLS interception conditions, this non-strict setting may weaken TLS peer identity validation and increase the risk of accepting a certificate for an unintended host. End-to-end exploitation is non-trivial in typical environments. This issue is fixed in versions 2.9.15 and 3.0.17.

Why it matters now

EPSS 0.00155 4th percentileScored 2026-11-07
Fix Partial ModSecurity (owasp-modsecurity): 2.9.15, 3.0.17Red Hat: 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
owasp-modsecurityModSecuritybefore 2.9.15; 3.0.0 to before 3.0.172.9.15, 3.0.17Patch availableCNA
  • ModSecurity Vendorowasp-modsecurity Affected before 2.9.15; 3.0.0 to before 3.0.17 Fixed in 2.9.15, 3.0.17 Patch available CNA

Remediation

Upgrade to ModSecurity 2.9.15 or 3.0.17. Red Hat lists Red Hat Enterprise Linux 7, 8, 9 and 10 and Red Hat JBoss Core Services as affected without a fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA ModSecurity (owasp-modsecurity) Fixed in 2.9.15, 3.0.17

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10Affected—
Red Hat Enterprise Linux 7Affected—
Red Hat Enterprise Linux 8Affected—
Red Hat Enterprise Linux 9Affected—
Red Hat JBoss Core ServicesAffected—

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-61813
  2. 2026-11-07 Affected versions changed · Red Hat
  3. 2026-11-07 CVSS score added · Red Hat

References

Other 5

  • TI-2026-37865 ModSecurity: Multipart form-data parser silently strips embedded line breaks from… CVSS 3.1HIGH 8.6
  • TI-2025-40548 FACTION Unauthenticated Custom Extension Upload leads to RCE CVSS 3.1CRITICAL 9.8
  • TI-2022-07517 Path Traversal in ESAPI CVSS 3.1CRITICAL 9.8
  • TI-2026-30581 ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators CVSS 4.0HIGH 8.2
  • TI-2026-23748 libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings CVSS 4.0HIGH 8.2
  • TI-2025-19980 Libmodsecurity3 has possible bypass of encoded HTML entities CVSS 4.0HIGH 7.9
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences