Description
apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | modsecurity-apache | 2.7.7-1 | — |
| Debian 13 | modsecurity-apache | 2.7.7-1 | — |
| Debian 12 | modsecurity-apache | 2.7.7-1 | — |
| Debian 7 | modsecurity-apache | 2.6.6-6+deb7u2 | DSA-2991-1 |
| Debian 6.0 | libapache-mod-security | 2.5.12-1+squeeze4 | DLA-34-1 |
Advisories 2
- DSA-2991-1 modsecurity-apache - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-34-1 libapache-mod-security - security update Debian Security (DSA / DLA) · Mar 9, 2026