{"id":"CVE-2026-73856","kind":"vulnerability","aliases":["CVE-2026-73856"],"related":[],"title":"ModSecurity: mixed-case Content-Type bypasses response body inspection rules","description":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can therefore be treated as unconfigured, causing ModSecurity to skip RESPONSE_BODY inspection. An unauthenticated requester can then receive response content that a phase 4 rule would otherwise block, including sensitive error or debug data. This issue is fixed in version 3.0.17.","summary":"ModSecurity compares response Content-Type values to its configured body MIME types case-sensitively, so a mixed-case media type is treated as unconfigured and its body is not inspected. An unauthenticated remote user can receive response content that a phase 4 rule would otherwise block, such as sensitive error or debug data.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache","iis","modsecurity","nginx","other","waf"],"not_affected_if":["no-response-body-rules","version-outside-3.0.0-to-3.0.17"],"how_to_check":"- Check the ModSecurity version the web server loads, from the module or library version in the server's packages (for example `apt list --installed | grep -i modsecurity` or `dnf info modsecurity`).\n- Look for `SecResponseBodyMimeType` in the ModSecurity or web server configuration to see whether response body inspection is set up.","fix":"- Move ModSecurity to `3.0.17` or later (affected: `3.0.0` through `3.0.17`, exclusive of the fix).","status":"open","published_at":"2026-11-05T16:17:48+00:00","first_seen_at":"2026-11-05T16:40:03+00:00","triaged_at":"2026-11-05T16:41:19+00:00","updated_at":"2026-11-05T16:41:19+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-05T16:41:19Z","model":"claude-haiku-5-5","output":{"fix":"- Move ModSecurity to `3.0.17` or later (affected: `3.0.0` through `3.0.17`, exclusive of the fix).","reach":"internet","title":"ModSecurity: mixed-case Content-Type bypasses response body inspection rules","impact":"medium","summary":"ModSecurity compares response Content-Type values to its configured body MIME types case-sensitively, so a mixed-case media type is treated as unconfigured and its body is not inspected. An unauthenticated remote user can receive response content that a phase 4 rule would otherwise block, such as sensitive error or debug data.","audience":"businesses","category":"other","nicknames":[],"who_cares":["modsecurity","apache","nginx","iis","waf"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated users receive response content a WAF rule should block","analyst_note":"","how_to_check":"- Check the ModSecurity version the web server loads, from the module or library version in the server's packages (for example `apt list --installed | grep -i modsecurity` or `dnf info modsecurity`).\n- Look for `SecResponseBodyMimeType` in the ModSecurity or web server configuration to see whether response body inspection is set up.","plain_action":"","needs_analyst":false,"not_affected_if":["version-outside-3.0.0-to-3.0.17","no-response-body-rules"],"who_is_affected":"Teams running ModSecurity 3.x as a web application firewall on Apache, IIS or Nginx with response body inspection enabled through SecResponseBodyMimeType. Exposure depends on the configured response MIME types and on phase 4 rules that block response content; installs without response body rules, or on versions outside 3.0.0 to 3.0.17, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000766,"input_tokens":4390,"output_tokens":654,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-73856':15A,18A '3.0.0':99C '3.0.17':101C,173C '4':69B,156C 'apach':19B,94C 'applic':89C 'block':73B,160C 'bodi':10A,35B,54B,143C 'bypass':8A 'case':4A,39B,45B,114C,119C 'case-sensit':38B,113C 'caus':138C 'compar':26B,103C 'configur':34B,129C 'content':6A,29B,65B,107C,152C 'content-typ':5A,28B,106C 'cross':86C 'cve':13A,16A 'data':80B,166C 'debug':79B,165C 'engin':92C 'entri':112C 'equival':126C 'error':77B,163C 'firewal':90C 'fix':170C 'ii':20B,95C 'includ':161C 'inspect':11A,57B,144C 'issu':168C 'lowercas':130C 'media':46B,121C 'mime':36B 'mix':3A,44B,118C 'mixed-cas':2A,43B,117C 'modsecur':1A,21B,25B,81C,139C 'nginx':22B,97C 'open':84C 'otherwis':72B,159C 'phase':68B,155C 'platform':87C 'receiv':63B,150C 'remot':60B 'request':147C 'respons':9A,27B,64B,105C,120C,142C,151C 'rule':12A,70B,157C 'secresponsebodymimetyp':111C 'semant':125C 'sensit':40B,76B,115C,162C 'skip':141C 'sourc':85C 'src/transaction.cc':102C 'therefor':133C 'treat':49B,135C 'type':7A,30B,37B,47B,108C,122C,131C 'unauthent':59B,146C 'unconfigur':51B,137C 'user':61B 'valu':31B,109C 'version':172C 'waf':24B,91C 'web':88C 'would':71B,158C","nicknames":[],"mitigations":[],"who_affected":"Teams running ModSecurity 3.x as a web application firewall on Apache, IIS or Nginx with response body inspection enabled through SecResponseBodyMimeType. Exposure depends on the configured response MIME types and on phase 4 rules that block response content; installs without response body rules, or on versions outside 3.0.0 to 3.0.17, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apache","high","iis","modsecurity","nginx","other","waf"],"campaign_type":null,"first_public_at":"2026-09-30T07:31:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-73856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73856","severity":null,"published_at":"2026-11-05T16:17:48+00:00","modified_at":"2026-11-05T16:17:48+00:00","first_seen_at":"2026-11-05T16:40:03+00:00","fetched_at":"2026-11-05T16:40:03+00:00","note":null}],"documents":[{"id":77661,"url":"https://github.com/owasp-modsecurity/ModSecurity/commit/23ccd9202114f8313df3773f7992782fd9949c98","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":77611,"url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":77663,"url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-vmg8-j66p-vgvw","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-30T07:31:00+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}