CVE-2026-73856
Received Received - Intake

ModSecurity Case-Sensitive Content-Type Bypass

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: GitHub, Inc.

Description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can therefore be treated as unconfigured, causing ModSecurity to skip RESPONSE_BODY inspection. An unauthenticated requester can then receive response content that a phase 4 rule would otherwise block, including sensitive error or debug data. This issue is fixed in version 3.0.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-73856
EUVD
EUVD-2026-117554

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
owasp-modsecurity ModSecurity >= 3.0.0, < 3.0.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-178 The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ModSecurity versions 3.0.0 to 3.0.17 have a case-sensitive comparison flaw in response Content-Type handling. This allows mixed-case media types to bypass RESPONSE_BODY inspection rules, potentially exposing sensitive data that should be blocked.

Detection Guidance

To detect this vulnerability, check if ModSecurity is running version 3.0.0 to 3.0.16. Inspect response Content-Type headers for mixed-case values like 'Text/Plain' that should match configured lowercase types. Use ModSecurity logs to verify if RESPONSE_BODY inspection is skipped for such cases.

Impact Analysis

An attacker could send requests with mixed-case Content-Type headers to bypass ModSecurity's response body inspection. This may expose sensitive error messages, debug data, or other protected content that would normally be blocked by security rules.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected ModSecurity versions may fail compliance audits if sensitive data is leaked due to this bypass.

Mitigation Strategies

Upgrade ModSecurity to version 3.0.17 or later to apply the case-insensitive Content-Type matching fix. If upgrading is not immediately possible, review and adjust SecResponseBodyMimeType rules to account for mixed-case variations in Content-Type headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73856. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...