---
id: CVE-2026-61813
title: >-
  ModSecurity: Incorrect libcurl TLS hostname verification setting in
  HttpsClient::download
summary: >-
  ModSecurity is an open source, cross platform web application firewall (WAF)
  engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the
  HttpsClient::download function in src/utils/https_client.cc sets libcurl
  CURLOPT_SSL_VERIFYHOS…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-295
vendor: owasp-modsecurity
product: ModSecurity
affected:
  - ModSecurity < 2.9.15
  - 'ModSecurity >= 3.0.0, < 3.0.17'
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T15:48:15.062Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-61813'
references:
  - url: >-
      https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-2vqc-36qp-ccmw
    label: >-
      https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-2vqc-36qp-ccmw
  - url: >-
      https://github.com/owasp-modsecurity/ModSecurity/commit/cce204806430e4848327aadeb9113e654631a0c1
    label: >-
      https://github.com/owasp-modsecurity/ModSecurity/commit/cce204806430e4848327aadeb9113e654631a0c1
  - url: >-
      https://github.com/owasp-modsecurity/ModSecurity/commit/edca70d853bfb725325137fa40d178beebc324fc
    label: >-
      https://github.com/owasp-modsecurity/ModSecurity/commit/edca70d853bfb725325137fa40d178beebc324fc
  - url: 'https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15'
    label: 'https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15'
  - url: 'https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17'
    label: 'https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17'
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.920Z'
epss: 0.00155
epssPercentile: 0.04619
---

## Overview

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOST to 1 instead of the strict value 2L. Under adversary-in-the-middle and TLS interception conditions, this non-strict setting may weaken TLS peer identity validation and increase the risk of accepting a certificate for an unintended host. End-to-end exploitation is non-trivial in typical environments. This issue is fixed in versions 2.9.15 and 3.0.17.

## Affected

- `ModSecurity < 2.9.15`
- `ModSecurity >= 3.0.0, < 3.0.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.