Inquiry About Upgrading ModSecurity Version Bundled with Ubuntu...

[Michael Bullut]

Good Afternoon Team,

I hope this e-mail finds you well.

I am reaching out to inquire about the process or recommendations for upgrading the version of ModSecurity that is bundled with Ubuntu. As you may know, Ubuntu’s repositories often include older versions of software, and I’ve noticed that the provided ModSecurity package is not the latest release.

Please advise on the best way to upgrade ModSecurity to the newest version on Ubuntu, specifically:

1. Are there official or recommended repositories or PPAs for obtaining the latest stable version of ModSecurity?
2. Does the ModSecurity CRS team provide guidance or documentation for such upgrades?
3. Are there any compatibility considerations when upgrading ModSecurity alongside the Core Rule Set?

I greatly appreciate the work you do to maintain and improve ModSecurity and the CRS, and I want to ensure I’m using the most up-to-date and secure versions. Thank you in advance for your time and assistance.

Warm regards,

Michael Bullut.

---

Cellphone: +254 723 393 114.

Twitter: @MichaelBullut

Blog: http://www.kipsang.com/
E-mail Address: ma...@kipsang.com

---

[Ervin Hegedüs]

Hi Michael,

On Mon, Jun 16, 2025 at 03:28:15PM +0300, 'Michael Bullut' via ModSecurity Core Rule Set project wrote:
> I am reaching out to inquire about the process or recommendations for
> upgrading the version of ModSecurity that is bundled with Ubuntu. As you
> may know, Ubuntu’s repositories often include older versions of software,
> and I’ve noticed that the provided ModSecurity package is not the latest
> release.

yes, this is a policy in case of most stable Linux distributions.

> Please advise on the best way to upgrade ModSecurity to the newest version
> on Ubuntu, specifically:
>

> 1. Are there official or recommended repositories or PPAs for obtaining

> the latest stable version of ModSecurity?

it's not an official, but here you can find the packages for all
supported Debian and Ubuntu systems:

https://modsecurity.digitalwave.hu

Note, that this repository provides only CRS 3.3, there is no
package for CRS 4 yet.

> 2. Does the ModSecurity CRS team provide guidance or documentation for
> such upgrades?

Uhm, sorry to ask, but are you looking for a documentation for
CRS or for ModSecurity?

> 3. Are there any compatibility considerations when upgrading ModSecurity

> alongside the Core Rule Set?

The last compatibility requirement was when we released CRS 3.3.3.
There we added a new conf file, REQUEST-922-MULTIPART-ATTACK, which
requires ModSecurity 2.9.6 or 3.0.8.

https://github.com/coreruleset/coreruleset/blob/v3.3/master/rules/REQUEST-922-MULTIPART-ATTACK.conf#L16

I think there is no other depedendency.


Regards,


a.