CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

security/modsecurity3 3.0.17

Intrusion detection and prevention engine

Maintainer
wolfgang.gerlach@proton.me
Packages
latest: 3.0.17
Upstream
up to date
Last update
to 3.0.17 · dde60ff180
Quarterly
2026Q4: 3.0.17 · last MFH 434bb26c80
Formerly
www/mod_security3 until 2018-11-27, www/mod_security-devel until 2018-02-12
WWW
https://www.modsecurity.org/
Links
cgit · VuXML

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 3.0.17.

Fixed (1)

Show 1 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (41)

Yusuf Yaman (nxjoseph) · 3.0.17 MFH 2026Q4 ✓
security/modsecurity3: Update 3.0.16 => 3.0.17

Changelog:
https://github.com/owasp-modsecurity/ModSecurity/blob/v3.0.17/CHANGES

PR:		299032
Approved by:	osa, vvd (Mentors, implicit)
Security:	GHSA-cxqf-vgrr-xxrv
Security:	GHSA-2vqc-36qp-ccmw
Security:	GHSA-jx3r-phvx-2jmj
Security:	GHSA-vmg8-j66p-vgvw
Security:	GHSA-5m93-4h75-3p2w
Security:	GHSA-qrch-pjfr-9g47
Security:	GHSA-4j47-8qcr-jf59
Security:	GHSA-5pww-8rfg-9crf
MFH:		2026Q4
dde60ff180
Yusuf Yaman (nxjoseph) · 3.0.16
security/modsecurity3: Update 3.0.15 => 3.0.16

Changelog:
https://github.com/owasp-modsecurity/ModSecurity/blob/v3.0.16/CHANGES

PR:		296385
Approved by:	osa, vvd (Mentors, implicit)
MFH:		2026Q2
Security:	CVE-2026-52761 (Details not yet available)
Security:	CVE-2026-52747 (Details not yet available)
9cfd1534f9
Bernhard Froehlich (decke) · 3.0.15
security/modsecurity3: Fix deprecated CPE_VENDOR
3476a92144
Jochen Neumeister (joneum) · 3.0.15
security/modsecurity3: Update to 3.0.15

Changes: https://github.com/owasp-modsecurity/ModSecurity/blob/v3.0.15/CHANGES
this fix CVE-2026-42268 CVE-2026-30923

Pass maintainership to submitter

PR:             294932
Approved by:    marius.halden@modirum.com
Sponsored by:	Netzkommune GmbH
e07a2381c0
Jochen Neumeister (joneum) · 3.0.14_1
security/(modsecurity3|modsecurity-nginx) : switch to PCRE2 and fix NGINX version

Change PCRE to PCRE2.
Update NGINX version to 1.28.2.

PR:	293279
Sponsored by:	Netzkommune GmbH
4972495533
Baptiste Daroussin (bapt) · 3.0.14_1
libxml2: chase libxml soversion bump
3068854dd0
Kurt Jaeger (pi) · 3.0.14
security/modsecurity3: update 3.0.13 -> 3.0.14, fix CVE

PR:		286413
Security:	CVE-2025-27110
Changes:	https://github.com/owasp-modsecurity/ModSecurity/blob/v3.0.14/CHANGES
Approved:	marius.halden@modirum.com (timeout)
d1c1abadce
Joel Bodenmann (jbo) · 3.0.13
security/modsecurity3: Update to 3.0.13

Changelog: https://github.com/owasp-modsecurity/ModSecurity/blob/v3.0.13/CHANGES

PR:		281472
Approved by:	portmgr (maintainer timeout, +3 weeks)
74a624f9f9
Kurt Jaeger (pi) · 3.0.12
security/modsecurity3: update 3.0.8 -> 3.0.12

- Trustwave transfered ModSecurity custodianship to OWASP
  effective January 25, 2024
- Fixes CVE 2024-1019

PR:		276817
Changes:	https://github.com/owasp-modsecurity/ModSecurity/releases
e1d28513d0
Fernando Apesteguía (fernape) · 3.0.8
security/modsecurity3: Update to v3.0.8

PR:		266786
Reported by:	marius.halden@modirum.com (maintainer)
01b8fffa03
Stefan Eßer (se) · 3.0.6
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 3.0.6
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Ryan Steinmetz (zi) · 3.0.6
security/modsecurity3: Update to 3.0.5

Approved by:	maintainer (via email)
6a77785b5b
Charlie Li (vishwin) · 3.0.5_2
textproc/libxml2: bump all LIB_DEPENDS consumers

This is a separate commit to facilitate easier cherry-picking for
quarterly.

PR: 262853, 262940, 262877, 263126
Approved by: fluffy (mentor)
d63665f7cd
Matthias Fechner (mfechner) · 3.0.5_1
textproc/libxml2: bump all dependencies

This should make sure that all dependent ports will pick
up the new version commited with a13ec21cd733f67a9fc0dc00ab45268bdc236246
247c7db751
Ryan Steinmetz (zi) · 3.0.5
security/modsecurity3: Update to 3.0.5

PR:		258801
Approved by: maintainer
0b71d7d972
Bernhard Froehlich (decke) · 3.0.4_2
security/modsecurity3: Add CPE information

Approved by:    portmgr (blanket)
42e9d0bbc8
Mathieu Arnold (mat) · 3.0.4_2
One more small cleanup, forgotten yesterday. Reported by:	lwhsu
cf118ccf87
Mathieu Arnold (mat) · 3.0.4_2
Remove # $FreeBSD$ from Makefiles.
305f148f48
Kyle Evans (kevans) · 3.0.4_2
security/modsecurity3: include unicode.mapping in package

This is included in the distribution and referenced in the default
configuration that's installed, but hasn't been included in the package. Do
so now.

PR:		250669
Submitted by:	Marius Halden <marius halden modirum com> (maintainer)
MFH:		2020Q4 (blanket: packaging fix)
d065828786
Li-Wen Hsu (lwhsu) · 3.0.4_1
security/modsecurity3: Add patch for CVE-2020-15598

PR:		249312
Submitted by:	Felipe Zipitria <fzipitria@perceptyx.com>
Approved by:	Marius Halden <marius.halden@modirum.com> (maintainer)
MFH:		2020Q3
Security:	CVE-2020-15598
6939bbd197
Jochen Neumeister (joneum) · 3.0.4
Update to 3.0.4

PR:		243410
Submitted by:	Marius Halden <marius.halden@modirum.com> (maintainer)
Sponsored by:	Netzkommune GmbH
827cc3d8f3
Gerald Pfeifer (gerald) · 3.0.3_3
Bump PORTREVISION for ports depending on the canonical version of GCC as defined in Mk/bsd.default-versions.mk which has moved from GCC 8.3 to GCC 9.1 under most circumstances now after revision 507371.

This includes ports
 - with USE_GCC=yes or USE_GCC=any,
 - with USES=fortran,
 - using Mk/bsd.octave.mk which in turn features USES=fortran, and
 - with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
   c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, everything INDEX-11 shows with a dependency on lang/gcc9 now.

PR:		238330
ea8c8ec7da
Jochen Neumeister (joneum) · 3.0.3_2
Change from libGeoIP to libmaxminddb and bump PORTREVISION

PR:		235154
Reported by:	Ralf van der Enden <tremere@cainites.net>
Approved by:	Marius Halden <marius.halden@modirum.com> (maintainer)
Sponsored by:	Netzkommune GmbH
9cadfae4c0
Adam Weinberger (adamw) · 3.0.3_1
Deprecate everything that depends on net/GeoIP and everything that depends on those ports.
b48ed2e966
Sergey A. Osokin (osa) · 3.0.3_1
Avoid to change the pkg-plist entry with every new release.

While I'm here pet portlint(1).
Bump PORTREVISION.

Approved by:	Marius Halden <marius.halden@modirum.com> (maintainer)
fd9773f1da
Dag-Erling Smørgrav (des) · 3.0.3
Upgrade to 3.0.3.

PR:		233566
Submitted by:	Marius Halden <marius.halden@modirum.com> (maintainer)
Differential Revision:	https://reviews.freebsd.org/D18357
020f9c9263
Gerald Pfeifer (gerald) · 3.0.2_3
Bump PORTREVISION for ports depending on the canonical version of GCC defined via Mk/bsd.default-versions.mk which has moved from GCC 7.4 t GCC 8.2 under most circumstances.

This includes ports
 - with USE_GCC=yes or USE_GCC=any,
 - with USES=fortran,
 - using Mk/bsd.octave.mk which in turn features USES=fortran, and
 - with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
   c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, as a double check, everything INDEX-11 showed depending on lang/gcc7.

PR:		231590
a9f015d155
Dag-Erling Smørgrav (des) · 3.0.2_2
Rename www/mod_security3 to security/modsecurity3.  It is not an Apache module, and the upstream name is ModSecurity in a single word.

PR:		233351
Submitted by:	Marie Helene Kvello-Aune, Marius Halden (maintainer)
Differential Revision:	https://reviews.freebsd.org/D18353
ef5258f6ed
Mark Linimon (linimon) · 3.0.2_1 · as www/mod_security3
Adjust USES to fix builds on gcc-bases archs.  While here, pet portlint.

Tested on powerpc64 and amd64.

Approved by:	portmgr (tier-2 blanket)
c12220ba5f
Gerald Pfeifer (gerald) · 3.0.2_1 · as www/mod_security3
Bump PORTREVISION for ports depending on the canonical version of GCC in the ports tree (via Mk/bsd.default-versions.mk and lang/gcc) which has now moved from GCC 6 to GCC 7 by default.

This includes ports
 - featuring USE_GCC=yes or USE_GCC=any,
 - featuring USES=fortran,
 - using Mk/bsd.octave.mk which in turn features USES=fortran, and those
 - with USES=compiler specifying one of openmp, nestedfct, c11, c++0x,
   c++11-lib, c++11-lang, c++14-lang, c++17-lang, or gcc-c++11-lib.

PR:		222542
09f9633cb6
Jochen Neumeister (joneum) · 3.0.2 · as www/mod_security3
Update to 3.0.2

PR:		227245
Submitted by:	Marius Halden <marius.halden@modirum.com> (maintainer)
04dcacdb29
Gerald Pfeifer (gerald) · 3.0.0_1 · as www/mod_security3
Bump PORTREVISIONs of all users of math/mpc that we just updated to version 1.1.0 (via revision 464079).
c2a92a1aea
Jochen Neumeister (joneum) · 3.0.0 · as www/mod_security3
Add PKGNAMESUFFIX

Reported by:	antoine (thanks)
Approved by:	mentors (implicit)
6afaeab479
Jochen Neumeister (joneum) · 3.0.0 · as www/mod_security-devel
www/mod_security-devel: Update to latest pre-release and rename it to www/mod_security3

Changelog: https://github.com/SpiderLabs/ModSecurity/releases/tag/v3.0.0

*While here:
 -switch to DISTVERSION
 -remove broken for aarch64, armv6 and armv7, this should be fixed in v3:
  https://github.com/SpiderLabs/ModSecurity/commit/968d83f1ff688c8158a3fe1c2fc375dd8548b97c

PR:		222877
Submitted by:	Marius Halden <marius.h@lden.org> (maintainer)
Approved by:	tcberner (mentor)
Differential Revision:	https://reviews.freebsd.org/D14118
2ea0f299ac
Mark Linimon (linimon) · 3.0.0.g2017080200_1 · as www/mod_security-devel
Mark several ports newly broken on arm.

While here, pet portlint.

Approved by:	portmgr (tier-2 blanket)
5324a23092
Gerald Pfeifer (gerald) · 3.0.0.g2017080200_1 · as www/mod_security-devel
Now that the default version of GCC in the ports tree is GCC 6, replace USE_GCC=6+ by USE_GCC=yes.
4dae3b097a
Gerald Pfeifer (gerald) · 3.0.0.g2017080200_1 · as www/mod_security-devel
Bump PORTREVISION for ports depending on the canonical version of GCC (via Mk/bsd.default-versions.mk and lang/gcc) which has moved from GCC 5.4 to GCC 6.4 under most circumstances.

This includes ports
 - with USE_GCC=yes or USE_GCC=any,
 - with USES=fortran,
 - using Mk/bsd.octave.mk which in turn features USES=fortran, and
 - with USES=compiler specifying openmp, nestedfct, c++11-lib, c++11-lang,
   c++14-lang, c++0x, c11, or gcc-c++11-lib.

PR:		219275
e59c88cece
Jochen Neumeister (joneum) · 3.0.0.g2017080200 · as www/mod_security-devel
- www/mod_security-devel: Update from 3.0.0.g2017072800 to 3.0.0.g2017080200

PR:		221174
Submitted by:	Marius Halden <marius.h@lden.org> (maintainer)
Approved by:	miwi (mentor)
Differential Revision:	https://reviews.freebsd.org/D11830
287f49d17c
Kurt Jaeger (pi) · 3.0.0.g2017072800 · as www/mod_security-devel
www/mod_security-devel: add comment to explain USE_GCC

PR:		220352
Submitted by:	Marius Halden <marius.h@lden.org>
197d5a0b06
Kurt Jaeger (pi) · 3.0.0.g2017072800 · as www/mod_security-devel
New port: www/mod_security-devel

ModSecurity is an embeddable web application firewall. It provides
protection from a range of attacks against web applications and allows
for HTTP traffic monitoring and real-time analysis with no changes to
existing infrastructure.

It is also an open source project that aims to make the web application
firewall technology available to everyone.

WWW: http://www.modsecurity.org/

PR:		220352
Submitted by:	Marius Halden <marius.h@lden.org>
05586a0a1a