ModSecurity patches four flaws across 3.0 and legacy 2.9 branches

The September 2026 ModSecurity batch ships libmodsecurity3 3.0.17 and mod_security2 2.9.15, fixing four vulnerabilities. The HTML decoding flaw CVE-2026-73857 affects the legacy 2.9.14 and earlier, while the other three affect libmodsecurity3 3.0.16 and earlier.

• CVE-2026-73857 in mod_security2 2.9.14 and earlier involves HTML entity decoding
• CVE-2026-73856, CVE-2026-61813 and CVE-2026-61812 are fixed in libmodsecurity3 3.0.17
• The fixed legacy release is mod_security2 2.9.15
• ZoomEye: 777,209 body-text matches but zero for a CVE-scoped query