---
id: "CVE-2026-61813"
kind: "vulnerability"
aliases: ["CVE-2026-61813"]
title: "ModSecurity: weak hostname check in rule-update downloads allows certificate mismatch"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache", "iis", "modsecurity", "nginx", "package", "waf"]
not_affected_if: ["default-config", "no-tls-interception"]
published_at: "2026-11-05T16:17:47+00:00"
first_seen_at: "2026-11-05T16:40:03+00:00"
updated_at: "2026-11-05T16:41:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61813", "first_seen_at": "2026-11-05T16:40:03+00:00"}]
exploit_sources: []
---

# ModSecurity: weak hostname check in rule-update downloads allows certificate mismatch

ModSecurity's HttpsClient::download sets libcurl's SSL host verification to 1 instead of the strict value 2, so it may accept a certificate issued for a different host. An attacker positioned in the middle of the connection or intercepting TLS could exploit this to impersonate a server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ModSecurity engine version with `modsecurity --version` or your package manager, and compare it with the fixed versions.
- Look for the HttpsClient::download code path in your build, if you compile ModSecurity from source.

## Fix

- ModSecurity 2.x: upgrade to `2.9.15`
- ModSecurity 3.x: upgrade to `3.0.17`

## Timeline

- 2026-11-05T16:40:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61813

## Documents

- [advisory] Vendor advisory: github.com https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-2vqc-36qp-ccmw
- [fix] Patch: github.com https://github.com/owasp-modsecurity/ModSecurity/commit/cce204806430e4848327aadeb9113e654631a0c1
- [fix] Patch: github.com https://github.com/owasp-modsecurity/ModSecurity/commit/edca70d853bfb725325137fa40d178beebc324fc
- [fix] Release notes: github.com https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15
- [fix] Release notes: github.com https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17

## From the sources

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOST to 1 instead of the strict value 2L. Under adversary-in-the-middle and TLS interception conditions, this non-strict setting may weaken TLS peer identity validation and increase the risk of accepting a certificate for an unintended host. End-to-end exploitation is non-trivial in typical environments. This issue is fixed in versions 2.9.15 and 3.0.17.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_