Hi,

The following vulnerabilities were published for modsecurity-apache.

CVE-2026-61812[0]:
| GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to evasion


CVE-2026-61813[1]:
| GHSA-2vqc-36qp-ccmw: Weak libcurl TLS hostname verification setting
| when fetching over HTTPS

and there are three more without yet a CVE assigned
(GHSA-5pww-8rfg-9crf, GHSA-qrch-pjfr-9g47, GHSA-4j47-8qcr-jf59)

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-61812
https://www.cve.org/CVERecord?id=CVE-2026-61812
[1] https://security-tracker.debian.org/tracker/CVE-2026-61813
https://www.cve.org/CVERecord?id=CVE-2026-61813
[2] https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

GHSA-5m93-4h75-3p2w -> CVE-2026-103932
GHSA-qrch-pjfr-9g47 -> CVE-2026-104259
GHSA-5pww-8rfg-9crf -> CVE-2026-104269

I'll use CVE ID's in d/changelog where it is possible.


Regards,


a.

GHSA-5m93-4h75-3p2w -> CVE-2026-103932
GHSA-qrch-pjfr-9g47 -> CVE-2026-104259
GHSA-5pww-8rfg-9crf -> CVE-2026-104269

I'll use CVE ID's in d/changelog where it is possible.


Regards,


a.

Hi Ervin,

Thanks, I have updated the security-tracker metadata as well

Regards,
Salvatore