← CVE Radar
CVE-2026-73856ModSecurity: Response Body Inspection Bypass
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can therefore be treated as unconfigured, causing ModSecurity to skip RESPONSE_BODY inspection. An unauthenticated requester can then receive response content that a phase 4 rule would otherwise block, including sensitive error or debug data. This issue is fixed in version 3.0.17.
8.6 HIGHEPSS 0.56%Not in KEVNVD: Received
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.6 | HIGH | 3.1GitHub_M (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Details
- CVE ID
- CVE-2026-73856
- Status
- Received
- Assigner (CNA)
- GitHub_M
- Published
- Nov 5, 2026
- Last modified
- 2026-11-05 16:17 UTC
- Weaknesses
- CWE-178 · Improper Handling of Case Sensitivity
Affected Products
As published by the CNA in the CVE record.
owasp-modsecurityModSecurity1 version range
- >= 3.0.0, < 3.0.17