ModSecurity · Issues· 349 open
Open on GitHubLocally synced open issues (discussions stay on GitHub)
- #3604
Windows build fails: yajl's Conan recipe sets CMP0026 OLD, incompatible with newer CMake
3.xwindowsUpdated Sep 17, 2026 - #3630
IIS: IPv6 link-local client addresses break IP matching ("IPmatch: bad IPv6 specification")
Platform - IIS2.xUpdated Sep 17, 2026 - #3619
IIS: Content-Length header corrupted/truncated for large responses (wrong printf format + off-by-one buffer size)
Platform - IIS2.xUpdated Sep 15, 2026 - #3621
IIS: Host header fallback is dead code (r->hostname == NULL can never be true)
Platform - IIS2.xUpdated Sep 15, 2026 - #3501
Feature Request: Add `ARGS_RAW`, `ARGS_GET_RAW`, `ARGS_POST_RAW`, and `ARGS_NAMES_RAW` Variables
new featureUpdated Sep 11, 2026 - #3563
REQBODY_ERROR "Extra content at the end of the document" after 3.0.15 update
3.xUpdated Sep 11, 2026 - #3131
@rbl operator does not support IPv6
bug2.x3.xduplicate:1st_place_medal: good first issueUpdated Aug 31, 2026 - #3623
IIS: ReadFileChunk allocates only 1 byte but reads m_dwPageSize (latent overflow)
Platform - IIS2.xUpdated Aug 27, 2026 - #3308
Drop YAJL dependency
2.x3.xUpdated Aug 24, 2026 - #3609
libModSecurity3: REQUEST_HEADERS names are treated as case sensitive with configure-time rule-exclusions
3.x:1st_place_medal: good first issueUpdated Aug 23, 2026 - #3601
Partial Log Forging in RuleMessage::log() via Unescaped Quote Characters in Request-Derived Fields
3.xUpdated Aug 23, 2026 - #3590
GnuTLS after many apache reloads
2.xUpdated Aug 23, 2026 - #3612
IIS connector: audit log F part always shows '500 Internal Server Error' for normal traffic
Platform - IIS2.xUpdated Aug 14, 2026 - #3610
multipart C-T header validation - false positive (rule id 200002, Multiple boundary parameters)
bug3.xUpdated Aug 13, 2026 - #3599
x86 IIS module in CI-built MSI fails to load - fuzzy.dll missing MinGW runtime DLLs (error 126)
2.xUpdated Aug 13, 2026