When Rule Downloads Lose Hostname Verification: CVE-2026-61812 in ModSecurity

A software flaw, CVE-2026-61812, has been discovered in two versions of the ModSecurity web application firewall. The vulnerability arises from a misconfigured libcurl setting that weakens Transport Layer Security (TLS) hostname verification during remote rule downloads. This flaw is separate from four other related issues patched in the same update, all of which impact how requests are inspected.

Remote rule sets allow ModSecurity to fetch detection logic from a remote server instead of embedding it in a config file. This feature relies on libcurl, which, when configured with a specific setting, weakens both certificate chain and hostname verification. While the certificate chain can still validate, the hostname check becomes less stringent.

This allows an attacker to intercept the connection through DNS manipulation, a hostile network path, or a compromised intermediary, and present a certificate that still passes the weakness check.

Exploiting this vulnerability requires the attacker to be in the network path, unlike another bug in the same update that could be exploited with a single malformed HTTP request. If the attacker gains control over the rule set, they could disable specific signatures, inject allow rules to exempt their traffic, or deliver a rule set that looks complete but isn't. Since the engine treats downloaded rules as authoritative, the firewall continues to report that it's protecting the application.

Organizations that fetch rules over the public internet are repeatedly exposed to this risk with each scheduled refresh. Those who vendor rules, sign them, and deploy from an internal artifact store are not affected by this flaw. ZoomEye data shows that 340 ModSecurity title matches, 27 application-fingerprint matches, 1,700 banner matches, and 777,209 body-text matches are recorded, but none indicate whether a host downloads rules from outside the network.

To remediate this vulnerability, organizations should upgrade to libmodsecurity3 version 3.0.17 or mod_security2 version 2.9.15. Alternatively, stopping remote rule fetching or mirroring rule sets into an internal store, pinning versions, verifying signatures or checksums, and deploying from there can also mitigate the risk. Restricting the destination to a known host, pinning the certificate instead of trusting the chain alone, and logging every refresh with the downloaded artefact hash can further enhance security.