CVE-2026-61813

OWASP ModSecurity sets libcurl CURLOPTSSLVERIFYHOST to 1 instead of 2 when downloading remote content SecRemoteRules and similar; v3 HttpsClient::download, v2 mscremotedownloadcontent, weakening TLS hostname verification. Affects v2 2.9.0-rc1 through 2.9.14 fixed 2.9.15 and v3 3.0.0-rc1 through...