Control Web Panel

Security => Mod_Security => Topic started by: anandmys on August 28, 2026, 05:57:46 AM

Title: allowed http versions mod security
Post by: anandmys on August 28, 2026, 05:57:46 AM
I get forbidden error when I open the https version of the website

Is this a bug or should I do something manually?


Quote
ModSecurity: Access denied with code 403 (phase 2). Match of "within %{tx.allowed_http_versions}" against "REQUEST_PROTOCOL" required. [file "/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_30_http_policy.conf"] [line "78"] [id "960034"] [rev "2"] [msg "HTTP protocol version is not allowed by policy"] [data "HTTP/2.0"] [severity "CRITICAL"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "9"] [tag "OWASP_CRS/POLICY/PROTOCOL_NOT_ALLOWED"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.10"] [hostname "a b c d.com"] [uri "/wink789/"] [unique_id "apEiQliJww8rVe16qDk28gABRQk"]
Title: Re: allowed http versions mod security
Post by: overseer on August 28, 2026, 04:46:54 PM
You could add 960034 to your global disabled rules...
Title: Re: allowed http versions mod security
Post by: Starburst on August 28, 2026, 06:20:39 PM
Curious also why you are running OWASP CRS v2.2.9

v4.29.0 was release about 2 weeks ago.
Title: Re: allowed http versions mod security
Post by: cyberspace on August 28, 2026, 09:36:30 PM
Make sure mod_http2 is updated and disable the mod_security rule 960034 as suggests @overseer.

Check this thread to find how to update mod_http2:
https://forum.centos-webpanel.com/apache/http2-bomb-remote-dos-exploit-hits-nginx-apache-iis-envoy-and-cloudflare/
Title: Re: allowed http versions mod security
Post by: Starburst on August 28, 2026, 09:40:09 PM
To update Apache to the latest with HTTP/2 you can see:

https://starburst.help/control-web-panel-cwp/control-web-panel-cwp-admin-tutorials/update-apache-http-2-to-2-4-68-in-cwp-on-almalinux-8-9/ (https://starburst.help/control-web-panel-cwp/control-web-panel-cwp-admin-tutorials/update-apache-http-2-to-2-4-68-in-cwp-on-almalinux-8-9/)