{"id":"CVE-2026-61813","kind":"vulnerability","aliases":["CVE-2026-61813"],"related":[],"title":"ModSecurity: weak hostname check in rule-update downloads allows certificate mismatch","description":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOST to 1 instead of the strict value 2L. Under adversary-in-the-middle and TLS interception conditions, this non-strict setting may weaken TLS peer identity validation and increase the risk of accepting a certificate for an unintended host. End-to-end exploitation is non-trivial in typical environments. This issue is fixed in versions 2.9.15 and 3.0.17.","summary":"ModSecurity's HttpsClient::download sets libcurl's SSL host verification to 1 instead of the strict value 2, so it may accept a certificate issued for a different host. An attacker positioned in the middle of the connection or intercepting TLS could exploit this to impersonate a server.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache","iis","modsecurity","nginx","package","waf"],"not_affected_if":["default-config","no-tls-interception"],"how_to_check":"- Check the installed ModSecurity engine version with `modsecurity --version` or your package manager, and compare it with the fixed versions.\n- Look for the HttpsClient::download code path in your build, if you compile ModSecurity from source.","fix":"- ModSecurity 2.x: upgrade to `2.9.15`\n- ModSecurity 3.x: upgrade to `3.0.17`","status":"open","published_at":"2026-11-05T16:17:47+00:00","first_seen_at":"2026-11-05T16:40:03+00:00","triaged_at":"2026-11-05T16:41:49+00:00","updated_at":"2026-11-05T16:41:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T16:41:49Z","model":"claude-haiku-5-5","output":{"fix":"- ModSecurity 2.x: upgrade to `2.9.15`\n- ModSecurity 3.x: upgrade to `3.0.17`","reach":"network","title":"ModSecurity: weak hostname check in rule-update downloads allows certificate mismatch","impact":"low","summary":"ModSecurity's HttpsClient::download sets libcurl's SSL host verification to 1 instead of the strict value 2, so it may accept a certificate issued for a different host. An attacker positioned in the middle of the connection or intercepting TLS could exploit this to impersonate a server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["modsecurity","apache","nginx","iis","waf"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"attacker accepts a certificate for an unintended host during download","analyst_note":"","how_to_check":"- Check the installed ModSecurity engine version with `modsecurity --version` or your package manager, and compare it with the fixed versions.\n- Look for the HttpsClient::download code path in your build, if you compile ModSecurity from source.","plain_action":"","needs_analyst":false,"not_affected_if":["no-tls-interception","default-config"],"who_is_affected":"Servers running ModSecurity 2.x before 2.9.15 or 3.x before 3.0.17 with Apache, IIS or Nginx connectors. The flaw affects outbound HTTPS downloads made by the engine, and the sources say exploitation is non-trivial in typical environments, requiring adversary-in-the-middle or TLS interception conditions. Deployments that do not make this HTTPS download path are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000752,"input_tokens":4427,"output_tokens":618,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-61813':15A,18A '1':36B,107C '2':42B '2.9.15':92C,165C '2l':113C '3.0.17':94C,167C 'accept':46B,140C 'adversari':116C 'adversary-in-the-middl':115C 'allow':10A 'apach':19B,86C 'applic':81C 'attack':55B 'certif':11A,48B,142C 'check':4A 'condit':123C 'connect':62B 'could':66B 'cross':78C 'curlopt':103C 'cve':13A,16A 'differ':52B 'download':9A,28B,97C 'end':148C,150C 'end-to-end':147C 'engin':84C 'environ':158C 'exploit':67B,151C 'firewal':82C 'fix':162C 'function':98C 'host':33B,53B,146C 'hostnam':3A 'httpsclient':27B,96C 'ident':133C 'ii':20B,87C 'imperson':70B 'increas':136C 'instead':37B,108C 'intercept':64B,122C 'issu':49B,160C 'libcurl':30B,102C 'may':45B,129C 'middl':59B,119C 'mismatch':12A 'modsecur':1A,21B,25B,73C 'nginx':22B,89C 'non':126C,154C 'non-strict':125C 'non-trivi':153C 'open':76C 'packag':23B 'peer':132C 'platform':79C 'posit':56B 'prior':90C 'risk':138C 'rule':7A 'rule-upd':6A 'server':72B 'set':29B,101C,128C 'sourc':77C 'src/utils/https_client.cc':100C 'ssl':32B,104C 'strict':40B,111C,127C 'tls':65B,121C,131C 'trivial':155C 'typic':157C 'unintend':145C 'updat':8A 'valid':134C 'valu':41B,112C 'verif':34B 'verifyhost':105C 'version':164C 'waf':24B,83C 'weak':2A 'weaken':130C 'web':80C","nicknames":[],"mitigations":[],"who_affected":"Servers running ModSecurity 2.x before 2.9.15 or 3.x before 3.0.17 with Apache, IIS or Nginx connectors. The flaw affects outbound HTTPS downloads made by the engine, and the sources say exploitation is non-trivial in typical environments, requiring adversary-in-the-middle or TLS interception conditions. Deployments that do not make this HTTPS download path are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apache","iis","low","modsecurity","nginx","package","waf"],"campaign_type":null,"first_public_at":"2026-09-30T07:28:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61813","severity":null,"published_at":"2026-11-05T16:17:47+00:00","modified_at":"2026-11-05T16:17:47+00:00","first_seen_at":"2026-11-05T16:40:03+00:00","fetched_at":"2026-11-05T16:40:03+00:00","note":null}],"documents":[{"id":77650,"url":"https://github.com/owasp-modsecurity/ModSecurity/commit/cce204806430e4848327aadeb9113e654631a0c1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":77651,"url":"https://github.com/owasp-modsecurity/ModSecurity/commit/edca70d853bfb725325137fa40d178beebc324fc","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":77615,"url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":77611,"url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":77654,"url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-2vqc-36qp-ccmw","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-30T07:28:36+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}