Modsecurity apache: [GHSA-2vqc-36qp-ccmw: Weak libcurl TLS hostname verification setting when fetching over HTTPS] (CVE-2026-61813)

This vulnerability (CVE-2026-61813) concerns modsecurity-apache's use of libcurl for HTTPS fetching, where the TLS hostname verification setting is weak. This could lead to improper verification of the server's TLS certificate hostname, potentially undermining the security of HTTPS connections made by modsecurity-apache. The affected versions are explicitly enumerated and include various 2.7.x, 2.9.x, and 3.0.x releases. There is no CVSS score or detailed technical exploit information available, and no known active exploitation has been reported.

The vulnerability may allow an attacker to bypass proper TLS hostname verification when modsecurity-apache fetches resources over HTTPS, potentially enabling man-in-the-middle attacks or interception of data. However, no known exploits in the wild have been reported, and the severity is assessed as medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting or monitoring HTTPS fetches performed by modsecurity-apache if feasible.