CVE-2026-73856 · Other
NO FIX YET · SEE WHAT TO DO
ModSecurity compares response Content-Type values to its configured body MIME types case-sensitively, so a mixed-case media type is treated as unconfigured and its body is not inspected. An unauthenticated remote user can receive response content that a phase 4 rule would otherwise block, such as sensitive error or debug data.
first public Sep 30, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running ModSecurity 3.x as a web application firewall on Apache, IIS or Nginx with response body inspection enabled through SecResponseBodyMimeType. Exposure depends on the configured response MIME types and on phase 4 rules that block response content; installs without response body rules, or on versions outside 3.0.0 to 3.0.17, are not affected.
Not affected if no-response-body-rules, version-outside-3.0.0-to-3.0.17
Who cares apache, iis, modsecurity, nginx, waf
apt list --installed | grep -i modsecurity or dnf info modsecurity).SecResponseBodyMimeType in the ModSecurity or web server configuration to see whether response body inspection is set up.3.0.17 or later (affected: 3.0.0 through 3.0.17, exclusive of the fix).ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can therefore be treated as unconfigured, causing ModSecurity to skip RESPONSE_BODY inspection. An unauthenticated requester can then receive response content that a phase 4 rule would otherwise block, including sensitive error or debug data. This issue is fixed in version 3.0.17.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.