Hi,

The following vulnerabilities were published for modsecurity.

CVE-2026-61812[0]:
| GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to evasion


CVE-2026-61813[1]:
| GHSA-2vqc-36qp-ccmw: Weak libcurl TLS hostname verification setting
| when fetching over HTTPS


CVE-2026-73856[2]:
| GHSA-vmg8-j66p-vgvw: Response body inspection bypass via non-canonical
| Content-Type casing


CVE-2026-73857[3]:
| GHSA-jx3r-phvx-2jmj: XML request body processor dereferences an
| uninitialized parser context pointer

And there are four more issues which have not yet CVEs assigned, they
originate from [4].


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-61812
https://www.cve.org/CVERecord?id=CVE-2026-61812
[1] https://security-tracker.debian.org/tracker/CVE-2026-61813
https://www.cve.org/CVERecord?id=CVE-2026-61813
[2] https://security-tracker.debian.org/tracker/CVE-2026-73856
https://www.cve.org/CVERecord?id=CVE-2026-73856
[3] https://security-tracker.debian.org/tracker/CVE-2026-73857
https://www.cve.org/CVERecord?id=CVE-2026-73857
[4] https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/

Regards,
Salvatore

Hi Salvatore,

thank you for opening this issue. I've been planning to make new
packages soon (probably today or tomorrow at least), but I hadn't
have enough time since the new releases. (Note, that there are
two affected packages: modsecurity and modsecurity-apache. The
first one has 8 issues, the second one has 6 from those 8.)

Regarding to the new packages: a few issues above (as you listed
them) don't have CVE ID's, only Github advisories. The reason is
simple: we requested CVE ID's through GH months ago, but still
haven't got them (for one, we received that yesterday).

What should I put into the d/changelog in these case? The
advisory ID is enough? Or should I put this issue ID? Or will you
open a DSA (or more?)

Thank you,


a.

Hi Salvatore,

thank you for opening this issue. I've been planning to make new
packages soon (probably today or tomorrow at least), but I hadn't
have enough time since the new releases. (Note, that there are
two affected packages: modsecurity and modsecurity-apache. The
first one has 8 issues, the second one has 6 from those 8.)

Regarding to the new packages: a few issues above (as you listed
them) don't have CVE ID's, only Github advisories. The reason is
simple: we requested CVE ID's through GH months ago, but still
haven't got them (for one, we received that yesterday).

What should I put into the d/changelog in these case? The
advisory ID is enough? Or should I put this issue ID? Or will you
open a DSA (or more?)

Thank you,


a.

Hi Ervin,

Yes, I filled a seperate bug for the src:modsecurity-apache issues.

Right to help us doing tracking, if there are no CVE available yet
then please at least mention the GHSA's that would be great (and
closing the respective filled bugs as well).

Not yet sure if we will release a DSA or a point release update is
enough, we will need to assess the severities of the issues.

Regards,
Salvatore

GHSA-5m93-4h75-3p2w -> CVE-2026-103932
GHSA-qrch-pjfr-9g47 -> CVE-2026-104259
GHSA-5pww-8rfg-9crf -> CVE-2026-104269

I'll use CVE ID's in d/changelog where it is possible.


Regards,


a.