Loading story…
OWASP ModSecurity maintenance releases fix multiple inspection flaws that could let crafted requests or responses evade web application firewall controls because ModSecurity and protected back-end applications interpret input differently. The issues affect multipart filename* handling under RFC 2231, URL-safe and malformed Base64 decoding, comment obfuscation normalization, multipart parsing, response-body Content-Type processing, XML parsing, and PCRE2 regex match-limit handling. High-severity GHSA-5pww-8rfg-9crf specifically involves inconsistent handling of multipart upload filenames, potentially allowing malicious uploads to bypass WAF rules.
Fixed upstream versions include libmodsecurity 3.0.17 and mod_security2 2.9.15, with exposure dependent on the deployed branch, enabled features, configuration, and distribution packaging. Debian modsecurity-apache packages on Debian 12, 13, and 14 were also flagged for unpatched CVE-2026-61812, rated CVSS 9.8 for remote, unauthenticated impact, although no public exploit or confirmed active exploitation was reported. Organizations should promptly apply applicable vendor updates, confirm the loaded engine and ruleset versions, test rules against malformed and obfuscated inputs, review fail-open behavior, and retain layered application defenses rather than relying solely on WAF signatures.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A Nessus Unix-agent plugin identified CVE-2026-61812 as unpatched on affected Debian Linux 12.0, 13.0, and 14.0 systems, including the Debian modsecurity-apache package. The plugin rates the issue as remotely exploitable with high confidentiality, integrity, and availability impact, while stating that no known exploits are available.
ModSecurity released maintenance updates addressing multipart filename handling, URL-safe Base64 decoding, comment obfuscation, PCRE2 match-limit errors, XML parsing, and response-body Content-Type processing. The associated upstream releases are libmodsecurity 3.0.17 and mod_security2 2.9.15; no active exploitation was confirmed by cited primary sources.
Multiple vulnerabilities were disclosed in OWASP ModSecurity that can let malicious inputs evade WAF inspection through parsing discrepancies, malformed-data handling, transformation failures, and resource-limit conditions. The issues include high-severity GHSA-5pww-8rfg-9crf, involving RFC 2231 multipart filename* handling, as well as Base64 decoding and comment-normalization flaws.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
linuxsecurity.com
Open sourcecybersecuritynews.com
Open sourcetenable.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security advisories disclosed multiple vulnerabilities across widely used web infrastructure components, including **OWASP ModSecurity**, **PHP**, and **Roundcube Webmail**. ModSecurity versions through `3.0.15` are affected by `CVE-2026-52761` and `CVE-2026-52747`, flaws that can let attackers bypass web application firewall inspection by exploiting truncated UTF-8 processing on i386 systems and discrepancies in `multipart/form-data` parsing. The issues were fixed in ModSecurity `3.0.16`, and defenders were advised to review rulesets that rely on input transformations and multipart inspection behavior. PHP also published fixes for `CVE-2026-12184` and `CVE-2026-14355`, which can trigger denial-of-service conditions in PHP-FPM and memory corruption through the OpenSSL extension’s AES-WRAP-PAD handling. Separately, Roundcube released security updates `1.6.17` and `1.7.2` for vulnerabilities affecting earlier versions of its webmail platform, with government guidance urging administrators to apply the patches. The disclosures highlight patching urgency across the web application stack, particularly for internet-facing services that depend on WAF filtering, PHP runtime stability, and webmail access.
Jul 6, 2026
The Apache Software Foundation released **Apache HTTP Server 2.4.68** to patch 13 vulnerabilities affecting versions prior to `2.4.68`, with many issues spanning `2.4.0` through `2.4.67`. The flaws span multiple modules, including `mod_http2`, `mod_proxy_ftp`, `mod_proxy_html`, `mod_ssl`, `mod_ldap`, `mod_dav_fs`, `mod_xml2enc`, and `mod_headers`, and include use-after-free, heap and buffer overflows, out-of-bounds reads, denial-of-service conditions, cross-site scripting, privilege-escalation and path-handling weaknesses. Apache and national defenders, including Canada’s Cyber Centre, urged administrators to review the advisory and upgrade because workarounds are unavailable for most of the issues. Notable CVEs include `CVE-2026-49975`, a `mod_http2` denial-of-service bug triggered by excessive size values in malicious HTTP/2 requests; `CVE-2026-48913`, a `mod_http2` memory-corruption issue when file handles are exhausted; `CVE-2026-34355` and `CVE-2026-34356`, buffer-overflow flaws tied to untrusted backend systems in `mod_proxy_html` and `ProxyPassReverseCookie*`; `CVE-2026-44631`, a heap underflow in `ap_regname` caused by crafted regular expressions; `CVE-2026-29167`, a `mod_ldap` per-directory use-after-free; `CVE-2026-29170` and `CVE-2026-44186` in `mod_proxy_ftp`; `CVE-2026-44185` in `mod_ssl` OCSP handling; and `CVE-2026-42535` in `mod_dav_fs`. The release also ships non-security changes such as OpenSSL 4.0 support and `mod_http2` updates, but the immediate priority for exposed environments is upgrading all Apache HTTP Server deployments to `2.4.68`.
Jun 29, 2026
Apache HTTP Server 2.4.39 fixed six vulnerabilities: `CVE-2019-0196`, `CVE-2019-0197`, `CVE-2019-0211`, `CVE-2019-0215`, `CVE-2019-0217`, and `CVE-2019-0220`. The issues included HTTP/2 memory-safety and crash conditions, a local privilege-escalation flaw affecting Unix MPMs, a TLS 1.3 client-certificate authorization bypass, an authentication race that could permit user impersonation, and inconsistent handling of repeated URL-path slashes. F5 reported that its supported products were not affected by `CVE-2019-0196`, `CVE-2019-0197`, or `CVE-2019-0220`. Apache’s broader 2.4 security record also documented risks in optional HTTP/2, proxy, session, TLS, and authentication components, including access-control bypasses and potential information disclosure or remote code execution in `mod_proxy_uwsgi`. Debian subsequently issued an LTS update for Debian 9’s `apache2` package, version `2.4.25-3+deb9u10`, fixing seven vulnerabilities—including `CVE-2020-1927`, `CVE-2020-1934`, `CVE-2020-35452`, `CVE-2021-26690`, `CVE-2021-26691`, `CVE-2021-30641`, and `CVE-2021-31618`—that could cause denial of service or incorrect `MergeSlashes` behavior; affected systems should upgrade their Apache packages.
Aug 29, 2026