Hi Alberto, On Wed, Jul 15, 2026 at 05:25:55PM +0200, Alberto Gonzalez Iniesta wrote: > Package: release.debian.org > Severity: normal > Tags: security > X-Debbugs-Cc: [email protected], [email protected], Debian > Security Team <[email protected]> > Control: affects -1 + src:modsecurity > User: [email protected] > Usertags: pu > > [ Reason ] > Fixes for CVE-2026-52747 and CVE-2026-52761 > > [ Impact ] > Security rules bypass. > > [ Tests ] > Fixed and tested by upstream. > > [ Risks ] > Low risk, simple patch. > > [ Checklist ] > [x] *all* changes are documented in the d/changelog > [x] I reviewed all changes and I approve them > [x] attach debdiff against the package in (old)stable > [x] the issue is verified as fixed in unstable > > [ Changes ] > Preserve line breaks from non-file form-field values. > Fix returned length of "unicode" variable.
> diff -Nru modsecurity-3.0.9/debian/changelog > modsecurity-3.0.9/debian/changelog > --- modsecurity-3.0.9/debian/changelog 2026-04-30 17:13:44.000000000 > +0200 > +++ modsecurity-3.0.9/debian/changelog 2026-06-30 19:11:37.000000000 > +0200 > @@ -1,3 +1,14 @@ > +modsecurity (3.0.9-1+deb12u3) bookworm; urgency=medium > + > + [ Alberto Gonzalez Iniesta ] > + * Restore d/changelog entry for deb12u1 > + * Fix CVE number > + > + [ Ervin Hegedus ] > + * Add fixes for CVE-2026-52747 and CVE-2026-52761 > + > + -- Ervin Hegedüs <[email protected]> Tue, 30 Jun 2026 19:11:37 +0200 As this proposed update targets 'bookworm'. Debian bookworm is now handed over to the LTS team, so no point releases are happening anymore, but updates are released via DLA's. I'm cc'ing the LTS list. Regards, Salvatore
