Source: modsecurity-apache Version: 2.9.13-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for modsecurity-apache. CVE-2026-61812[0]: | GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to evasion CVE-2026-61813[1]: | GHSA-2vqc-36qp-ccmw: Weak libcurl TLS hostname verification setting | when fetching over HTTPS and there are three more without yet a CVE assigned (GHSA-5pww-8rfg-9crf, GHSA-qrch-pjfr-9g47, GHSA-4j47-8qcr-jf59) If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-61812 https://www.cve.org/CVERecord?id=CVE-2026-61812 [1] https://security-tracker.debian.org/tracker/CVE-2026-61813 https://www.cve.org/CVERecord?id=CVE-2026-61813 [2] https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/ Please adjust the affected versions in the BTS as needed. Regards, Salvatore
