Issues

• Lua m.getvar()/m.getvars(): long transformation tables crash, and "none" doesn't reset in v3

  2.x3.xbug
  owasp-modsecurity/ModSecurity#3737 · Filter by author fzipi opened on Nov 2, 2026

• Support nested RULE macros in RULE.msg and RULE.logdata with safe recursion handling

  owasp-modsecurity/ModSecurity#3735 · Filter by author coderabbitai opened on Nov 1, 2026
  

• %{RULE.*} expands to an empty string in SecAction and SecRuleScript

  3.x
  owasp-modsecurity/ModSecurity#3733 · Filter by author airween opened on Nov 1, 2026

• v3: Lua m.setvar() returns -1 on errors, so the script gets stack garbage

  3.xbug
  owasp-modsecurity/ModSecurity#3731 · Filter by author fzipi opened on Nov 1, 2026

• v2: !@validateHash matches when the regex fails (same as #3123)

  2.xbug
  owasp-modsecurity/ModSecurity#3710 · Filter by author fzipi opened on Oct 26, 2026

• v3: "General failure, action: 0x..." prints a pointer instead of the action name

  3.xbug
  owasp-modsecurity/ModSecurity#3708 · Filter by author fzipi opened on Oct 26, 2026

• v3: setvar added by SecRuleUpdateActionById to a chain starter only runs on full chain match

  3.xbug
  owasp-modsecurity/ModSecurity#3707 · Filter by author fzipi opened on Oct 26, 2026
  1

• escapeSeqDecode transformation missing support for ANSI-C unicode encoding

  owasp-modsecurity/ModSecurity#3701 · Filter by author EsadCetiner opened on Oct 19, 2026

• Multipart: data after the final boundary in a later chunk sets MULTIPART_DATA_BEFORE instead of MULTIPART_DATA_AFTER

  2.x3.xbug
  owasp-modsecurity/ModSecurity#3695 · Filter by author fzipi opened on Oct 15, 2026
  1

  

• DURATION measures process CPU time in seconds, not elapsed transaction time in milliseconds

  3.x
  owasp-modsecurity/ModSecurity#3694 · Filter by author airween opened on Oct 15, 2026
  2

• v2: t:utf8toUnicode drops the last hex digit of code points above U+FFFF (regression since 2.9.9)

  owasp-modsecurity/ModSecurity#3684 · Filter by author fzipi opened on Oct 13, 2026

• v2: msc_xml.c prints libxml2 errors to stderr and discards the parse reason

  2.xenhancementpr available
  owasp-modsecurity/ModSecurity#3680 · Filter by author fzipi opened on Oct 13, 2026
  1

  

• XML body processor: surface libxml2's parse error in REQBODY_ERROR_MSG and the debug log

  3.xenhancementpr available
  owasp-modsecurity/ModSecurity#3678 · Filter by author fzipi opened on Oct 13, 2026

• Internal error codes are bare negative integers without names or messages (v2 and v3)

  2.x3.xenhancementpr available
  owasp-modsecurity/ModSecurity#3655 · Filter by author fzipi opened on Oct 12, 2026
  2

  

• IIS: IPv6 link-local client addresses break IP matching ("IPmatch: bad IPv6 specification")

  2.xbugPlatform - IISpr availablewindows
  owasp-modsecurity/ModSecurity#3630 · Filter by author A13501350 opened on Sep 17, 2026
  1

• IIS: ReadFileChunk allocates only 1 byte but reads m_dwPageSize (latent overflow)

  2.xbugPlatform - IISpr availablewindows
  owasp-modsecurity/ModSecurity#3623 · Filter by author A13501350 opened on Aug 27, 2026
  2

• IIS: Host header fallback is dead code (r->hostname == NULL can never be true)

  2.xbugPlatform - IISpr availablewindows
  owasp-modsecurity/ModSecurity#3621 · Filter by author A13501350 opened on Aug 27, 2026
  2

• IIS: Content-Length header corrupted/truncated for large responses (wrong printf format + off-by-one buffer size)

  2.xbugPlatform - IISpr availablewindows
  owasp-modsecurity/ModSecurity#3619 · Filter by author A13501350 opened on Aug 27, 2026
  2

• IIS connector: audit log F part always shows '500 Internal Server Error' for normal traffic

  2.xbugPlatform - IISpr availablewindows
  owasp-modsecurity/ModSecurity#3612 · Filter by author A13501350 opened on Aug 14, 2026
  2

• multipart C-T header validation - false positive (rule id 200002, Multiple boundary parameters)

  3.xbugpr available
  owasp-modsecurity/ModSecurity#3610 · Filter by author zyro23 opened on Aug 13, 2026
  4

• libModSecurity3: REQUEST_HEADERS names are treated as case sensitive with configure-time rule-exclusions

  3.xpr available🥇 good first issue
  owasp-modsecurity/ModSecurity#3609 · Filter by author EsadCetiner opened on Aug 7, 2026
  3

• Windows build fails: yajl's Conan recipe sets CMP0026 OLD, incompatible with newer CMake

  3.xpr availablewindows
  owasp-modsecurity/ModSecurity#3604 · Filter by author fzipi opened on Jul 28, 2026
  3

• Partial Log Forging in RuleMessage::log() via Unescaped Quote Characters in Request-Derived Fields

  3.xneeds decision
  owasp-modsecurity/ModSecurity#3601 · Filter by author amitu314 opened on Jul 20, 2026
  4

• x86 IIS module in CI-built MSI fails to load - fuzzy.dll missing MinGW runtime DLLs (error 126)

  2.xpr availablewindows
  owasp-modsecurity/ModSecurity#3599 · Filter by author webwizuk opened on Jul 17, 2026
  2

• GnuTLS after many apache reloads

  2.xbugpr available
  owasp-modsecurity/ModSecurity#3590 · Filter by author Nachtlichtermeer opened on Jun 29, 2026
  10