owasp-modsecurity has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was November 2026 with 4. The median CVSS is 7.2 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
CVE-2026-73856High· 8.6ModSecurity: Response Body Inspection Bypass47CVE-2026-104269High· 8.6ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)47CVE-2026-103932Medium· 5.8ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match32CVE-2026-61813Low· 3.7ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download20
owasp-modsecurity vulnerabilities
CVEs affecting owasp-modsecurity, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-104269High· 8.6ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by com…
CVE-2026-73856High· 8.6ModSecurity: Response Body Inspection Bypass
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries cas…
CVE-2026-61813Low· 3.7ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOS…
CVE-2026-103932Medium· 5.8ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors i…