CVE-2026-61812: ModSecurity: HTML decoder missing entities, leading to evasion

Q: Which deployments are exposed?

Deployments using ModSecurity before 2.9.15 or 3.0.17 are affected if their rules rely on the t:htmlEntityDecode transformation when inspecting request content. This applies to ModSecurity deployments for Apache, IIS, or Nginx where such rules are enabled.

Q: What does an attacker need to do to bypass affected rules?

An attacker must submit input containing ASCII separators or operators encoded with named HTML entities that the decoder does not handle, including aliases. In version 3, invalid longer entity names may also be transformed because the decoder accepts prefix matches rather than requiring an exact entity-token length.

Q: Are all ModSecurity rules affected by this issue?

No. The described bypass applies to rules that depend on t:htmlEntityDecode, because the transformation can produce different bytes from those interpreted by a browser or backend.

Q: How can this be remediated?

Upgrade ModSecurity to version 2.9.15 or 3.0.17, which contain the fix.

Published Nov 9, 2026

Updated

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, t:htmlEntityDecode recognizes only a small subset of named HTML entities, so rules that depend on the transformation can inspect different bytes than a browser or backend. Attackers can encode ASCII separators and operators with unhandled entity names, including aliases, to bypass rules that depend on the transformation. The v3 decoder also accepts prefix matches instead of requiring an exact entity-token length, which can transform invalid longer names into different bytes. This issue is fixed in versions 2.9.15 and 3.0.17.

Affected Software

1 affected component

OWASP Modsecurity<2.9.15, <3.0.17

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ModSecurity 2.x to a version that resolves this vulnerability.
Fixed in 2.9.15
Upgrade
Upgrade ModSecurity 3.x to a version that resolves this vulnerability.
Fixed in 3.0.17

Event History

Nov 9, 2026

CVE Published

via MITRE·09:37 PM

Data Sourced

via MITRE·09:37 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using ModSecurity before 2.9.15 or 3.0.17 are affected if their rules rely on the t:htmlEntityDecode transformation when inspecting request content. This applies to ModSecurity deployments for Apache, IIS, or Nginx where such rules are enabled.

What does an attacker need to do to bypass affected rules?

An attacker must submit input containing ASCII separators or operators encoded with named HTML entities that the decoder does not handle, including aliases. In version 3, invalid longer entity names may also be transformed because the decoder accepts prefix matches rather than requiring an exact entity-token length.

Are all ModSecurity rules affected by this issue?

No. The described bypass applies to rules that depend on t:htmlEntityDecode, because the transformation can produce different bytes from those interpreted by a browser or backend.

How can this be remediated?

Upgrade ModSecurity to version 2.9.15 or 3.0.17, which contain the fix.

CVE-2026-61812: ModSecurity: HTML decoder missing entities, leading to evasion

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to do to bypass affected rules?

Are all ModSecurity rules affected by this issue?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to do to bypass affected rules?

Are all ModSecurity rules affected by this issue?

How can this be remediated?