Hello ModSecurity team,

First of all, thank you for your excellent work on ModSecurity (v3 / libmodsecurity) — it’s a great WAF library.

I attempted to build ModSecurity v3 against thelatest Mbed TLS release (4.0.0), but the build fails right at the./configure step. The error message is as follows:

# Check for Mbed TLSif ! test -f "${srcdir}/others/mbedtls/library/base64.c"; then  AC_MSG_ERROR([    Mbed TLS was not found within ModSecurity source directory.    …  ])fi

The root cause appears to bethe removal or relocation oflibrary/base64.c (and possibly other files) in Mbed TLS 4.x, so the check in ModSecurity’s build system which expects that file fails.

According to the Mbed TLS 4.0.0 release notes, there are“significant API changes that break backward compatibility”.

Questions

1. Is support for Mbed TLS 4.x planned in ModSecurity v3?

2. If yes:

   • Is there a rough timeline, release version, or roadmap entry for that?
   • Are there existing branches or PRs to track for this work?

3. If no or not yet:

   • Would the maintainers accept a community contribution / PR to enable building with Mbed TLS 4.x (including updating the configure script check and necessary code changes)?
   • Could documentation be updated to state clearly which Mbed TLS versions are supported (e.g., “Up to Mbed TLS 3.x only”)?

Thank you very much for your time and the continued maintenance of ModSecurity.
Best regards,