Is CVE-2026-61812 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61812 being exploited in the wild.

How severe is CVE-2026-61812?

Informational severity, published 9 November 2026.

Which products and versions are affected?

OWASP Modsecurity 2.x prior to 2.9.15; 3.x prior to 3.0.17.

Is there a fix for CVE-2026-61812?

Yes: fixed in ModSecurity 2.9.15, 3.0.17. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61812 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-61812?

Check whether you run OWASP Modsecurity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61812: ModSecurity htmlEntityDecode rule bypass via incomplete entity handling

CVE-2026-61812 · Severity: info · Published 2026-11-09

ModSecurity is a web application firewall that inspects HTTP traffic to block malicious requests. Due to incomplete handling of HTML entity names in its transformation rules, attackers can encode characters used in attacks (like Log4Shell payloads) in ways the firewall fails to recognize, allowing malicious requests to bypass security rules that other tools would catch.

Technologies: OWASP Modsecurity. Vendors: OWASP.

Quick answers

Is CVE-2026-61812 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61812 being exploited in the wild.
How severe is CVE-2026-61812?: Informational severity, published 9 November 2026.
Which products and versions are affected?: OWASP Modsecurity 2.x prior to 2.9.15; 3.x prior to 3.0.17.
Is there a fix for CVE-2026-61812?: Yes: fixed in ModSecurity 2.9.15, 3.0.17. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61812 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-61812?: Check whether you run OWASP Modsecurity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: ModSecurity 2.9.15, 3.0.17

Technical details

The htmlEntityDecode transformation in ModSecurity versions prior to 2.9.15 and 3.0.17 does not recognize the full WHATWG standard set of named HTML entities, allowing attackers to encode ASCII separators and operators with unrecognized entity aliases to evade rule detection. Additionally, the v3 decoder accepts prefix matches rather than exact entity-token length matching, causing invalid longer entity names to be incorrectly transformed. This is a logic flaw in input normalization that enables WAF bypass with no authentication or user interaction required.

Affected products

OWASP ModSecurity 2.x prior to 2.9.15; 3.x prior to 3.0.17

Timeline

2026-11-09: disclosed
2026-11-09: patched: Fixes regenerate entity table from WHATWG specification

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.