AZL-113083: CVE-2026-61812 affecting package mod_security 2.9.7-8

Q: Who is exposed to this issue?

Deployments using ModSecurity before 2.9.15 or 3.0.17 are exposed when their rules rely on the t:htmlEntityDecode transformation to inspect request content.

Q: What does an attacker need to do to bypass affected rules?

An attacker can encode ASCII separators or operators with named HTML entities that the decoder does not handle, including aliases. In affected v3 releases, prefix matching can also cause invalid longer entity names to decode into different bytes.

Q: Are all ModSecurity rules affected?

No. The issue affects rules whose detection or blocking logic depends on t:htmlEntityDecode; rules that do not rely on that transformation are not identified as affected by the available data.

Q: What versions fix the issue?

Upgrade ModSecurity to version 2.9.15 or 3.0.17, depending on the major version in use.

Published Nov 9, 2026

Updated

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, t:htmlEntityDecode recognizes only a small subset of named HTML entities, so rules that depend on the transformation can inspect different bytes than a browser or backend. Attackers can encode ASCII separators and operators with unhandled entity names, including aliases, to bypass rules that depend on the transformation. The v3 decoder also accepts prefix matches instead of requiring an exact entity-token length, which can transform invalid longer names into different bytes. This issue is fixed in versions 2.9.15 and 3.0.17.

Affected Software

1 affected component

azure-linux/mod_security<=2.9.7-8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade mod_security to a version that resolves this vulnerability.
Fixed in 2.9.15
Upgrade
Upgrade mod_security to a version that resolves this vulnerability.
Fixed in 3.0.17

Event History

Nov 9, 2026

Advisory Published

via OSV·10:18 PM

Data Sourced

via OSV·10:18 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-61812

Frequently Asked Questions

Who is exposed to this issue?

Deployments using ModSecurity before 2.9.15 or 3.0.17 are exposed when their rules rely on the t:htmlEntityDecode transformation to inspect request content.

What does an attacker need to do to bypass affected rules?

An attacker can encode ASCII separators or operators with named HTML entities that the decoder does not handle, including aliases. In affected v3 releases, prefix matching can also cause invalid longer entity names to decode into different bytes.

Are all ModSecurity rules affected?

No. The issue affects rules whose detection or blocking logic depends on t:htmlEntityDecode; rules that do not rely on that transformation are not identified as affected by the available data.

What versions fix the issue?

Upgrade ModSecurity to version 2.9.15 or 3.0.17, depending on the major version in use.

AZL-113083: CVE-2026-61812 affecting package mod_security 2.9.7-8

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to bypass affected rules?

Are all ModSecurity rules affected?

What versions fix the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to bypass affected rules?

Are all ModSecurity rules affected?

What versions fix the issue?