ModSecurity CVE-2026-61812 weakens hostname checks on rule downloads
Four ModSecurity flaws were patched, including CVE-2026-61812: a misconfigured libcurl setting weakens TLS hostname verification during remote rule downloads. libmodsecurity3 up to 3.0.16 and mod_security2 up to 2.9.14 are affected; fixes are in 3.0.17 and 2.9.15.
- CVE-2026-61812 weakens hostname verification in libcurl during rule downloads
- Affected: libmodsecurity3 ≤ 3.0.16 and mod_security2 ≤ 2.9.14
- Fixes shipped in libmodsecurity3 3.0.17 and mod_security2 2.9.15
- Exploitation requires a network position, such as DNS manipulation
Read next
Business