CVE-2026-61813

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-61813", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-10T20:17:57.991Z", "datePublished": "2026-11-05T15:48:15.062Z", "dateUpdated": "2026-11-09T16:51:40.862Z"}, "containers": {"cna": {"title": "ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download", "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "lang": "en", "description": "CWE-295: Improper Certificate Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-2vqc-36qp-ccmw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-2vqc-36qp-ccmw"}, {"name": "https://github.com/owasp-modsecurity/ModSecurity/commit/cce204806430e4848327aadeb9113e654631a0c1", "tags": ["x_refsource_MISC"], "url": "https://github.com/owasp-modsecurity/ModSecurity/commit/cce204806430e4848327aadeb9113e654631a0c1"}, {"name": "https://github.com/owasp-modsecurity/ModSecurity/commit/edca70d853bfb725325137fa40d178beebc324fc", "tags": ["x_refsource_MISC"], "url": "https://github.com/owasp-modsecurity/ModSecurity/commit/edca70d853bfb725325137fa40d178beebc324fc"}, {"name": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15", "tags": ["x_refsource_MISC"], "url": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15"}, {"name": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17", "tags": ["x_refsource_MISC"], "url": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"}], "affected": [{"vendor": "owasp-modsecurity", "product": "ModSecurity", "versions": [{"version": "< 2.9.15", "status": "affected"}, {"version": ">= 3.0.0, < 3.0.17", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T15:48:15.062Z"}, "descriptions": [{"lang": "en", "value": "ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOST to 1 instead of the strict value 2L. Under adversary-in-the-middle and TLS interception conditions, this non-strict setting may weaken TLS peer identity validation and increase the risk of accepting a certificate for an unintended host. End-to-end exploitation is non-trivial in typical environments. This issue is fixed in versions 2.9.15 and 3.0.17."}], "source": {"advisory": "GHSA-2vqc-36qp-ccmw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T16:10:12.729362Z", "id": "CVE-2026-61813", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:51:40.862Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-61813", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T16:10:12.729362Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:10:13.807Z"}}], "cna": {"title": "ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download", "source": {"advisory": "GHSA-2vqc-36qp-ccmw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "owasp-modsecurity", "product": "ModSecurity", "versions": [{"status": "affected", "version": "< 2.9.15"}, {"status": "affected", "version": ">= 3.0.0, < 3.0.17"}]}], "references": [{"url": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-2vqc-36qp-ccmw", "name": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-2vqc-36qp-ccmw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/owasp-modsecurity/ModSecurity/commit/cce204806430e4848327aadeb9113e654631a0c1", "name": "https://github.com/owasp-modsecurity/ModSecurity/commit/cce204806430e4848327aadeb9113e654631a0c1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/owasp-modsecurity/ModSecurity/commit/edca70d853bfb725325137fa40d178beebc324fc", "name": "https://github.com/owasp-modsecurity/ModSecurity/commit/edca70d853bfb725325137fa40d178beebc324fc", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15", "name": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17", "name": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOST to 1 instead of the strict value 2L. Under adversary-in-the-middle and TLS interception conditions, this non-strict setting may weaken TLS peer identity validation and increase the risk of accepting a certificate for an unintended host. End-to-end exploitation is non-trivial in typical environments. This issue is fixed in versions 2.9.15 and 3.0.17."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295: Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T15:48:15.062Z"}}}, "cveMetadata": {"cveId": "CVE-2026-61813", "state": "PUBLISHED", "dateUpdated": "2026-11-09T16:51:40.862Z", "dateReserved": "2026-07-10T20:17:57.991Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-05T15:48:15.062Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ModSecurity", "vendor": "owasp-modsecurity", "versions": [{"status": "affected", "version": "< 2.9.15"}, {"status": "affected", "version": ">= 3.0.0, < 3.0.17"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOST to 1 instead of the strict value 2L. Under adversary-in-the-middle and TLS interception conditions, this non-strict setting may weaken TLS peer identity validation and increase the risk of accepting a certificate for an unintended host. End-to-end exploitation is non-trivial in typical environments. This issue is fixed in versions 2.9.15 and 3.0.17."}], "id": "CVE-2026-61813", "lastModified": "2026-11-12T20:04:52.377", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61813", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T16:10:12.729362Z", "version": "2.0.3"}}]}, "published": "2026-11-05T16:17:47.797", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/owasp-modsecurity/ModSecurity/commit/cce204806430e4848327aadeb9113e654631a0c1"}, {"source": "security-advisories@github.com", "url": "https://github.com/owasp-modsecurity/ModSecurity/commit/edca70d853bfb725325137fa40d178beebc324fc"}, {"source": "security-advisories@github.com", "url": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15"}, {"source": "security-advisories@github.com", "url": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"}, {"source": "security-advisories@github.com", "url": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-2vqc-36qp-ccmw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "mod_security: modsecurity: ModSecurity: Weak TLS certificate validation via improper hostname verification", "id": "2567914", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567914"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-295", "details": ["A flaw was found in ModSecurity. An attacker positioned in the communication path can bypass peer identity verification due to an improper Transport Layer Security (TLS) hostname validation setting in the internal HTTPS client. This issue allows the attacker to present a certificate issued for an unintended host, potentially enabling them to intercept or tamper with encrypted traffic."], "mitigation": {"lang": "en:us", "value": "Avoid using remote rule retrieval over HTTPS by loading rule sets locally from the host filesystem.\nIn the web server configuration (such as `/etc/httpd/conf.d/mod_security.conf`), remove or comment out any `SecRemoteRules` directives pointing to remote HTTPS endpoints. Instead, deploy rule files locally and reference them using standard `Include` directives.\nApply the configuration change by reloading the web server:\n```\nsystemctl reload httpd\n```\nCaveats: Switching from remote rules requires synchronizing and deploying rule files locally using configuration management or local packages.\nWarning: Reloading the web server service will temporarily disrupt the processing of configuration directives and may cause brief connection delays."}, "name": "CVE-2026-61813", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "mod_security", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Under investigation", "package_name": "mod_security", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "mod_security", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "mod_security", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Under investigation", "package_name": "jbcs-httpd24-mod_security", "product_name": "Red Hat JBoss Core Services"}], "public_date": "2026-11-05T15:48:15Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-61813\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-61813\nhttps://github.com/owasp-modsecurity/ModSecurity/commit/cce204806430e4848327aadeb9113e654631a0c1\nhttps://github.com/owasp-modsecurity/ModSecurity/commit/edca70d853bfb725325137fa40d178beebc324fc\nhttps://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15\nhttps://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17\nhttps://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-2vqc-36qp-ccmw"], "statement": "This vulnerability is rated as having a Low impact because exploitation requires an adversary-in-the-middle network position and only affects non-default configurations that retrieve external rules over HTTPS. Standard deployments on Red Hat Enterprise Linux typically utilize locally provisioned rule files, such as the Core Rule Set provided by system RPMs, rather than fetching remote rulesets dynamically at runtime. Because hostname verification is only weakened during outbound remote rule retrieval, standard request inspection and web application firewall operations for inbound client traffic remain unaffected.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.9.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.0.17)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ModSecurity", "source": "cna", "vendor": "owasp-modsecurity"}, "product": "modsecurity", "vendor": "modsecurity"}], "created": "2026-11-05T17:45:06.313105+00:00", "updated": "2026-11-05T18:00:20.450041+00:00", "vendors": ["modsecurity", "modsecurity$PRODUCT$modsecurity"]}