---
id: "CVE-2026-73856"
kind: "vulnerability"
aliases: ["CVE-2026-73856"]
title: "ModSecurity: mixed-case Content-Type bypasses response body inspection rules"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["apache", "iis", "modsecurity", "nginx", "other", "waf"]
not_affected_if: ["no-response-body-rules", "version-outside-3.0.0-to-3.0.17"]
published_at: "2026-11-05T16:17:48+00:00"
first_seen_at: "2026-11-05T16:40:03+00:00"
updated_at: "2026-11-05T16:41:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73856", "first_seen_at": "2026-11-05T16:40:03+00:00"}]
exploit_sources: []
---

# ModSecurity: mixed-case Content-Type bypasses response body inspection rules

ModSecurity compares response Content-Type values to its configured body MIME types case-sensitively, so a mixed-case media type is treated as unconfigured and its body is not inspected. An unauthenticated remote user can receive response content that a phase 4 rule would otherwise block, such as sensitive error or debug data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the ModSecurity version the web server loads, from the module or library version in the server's packages (for example `apt list --installed | grep -i modsecurity` or `dnf info modsecurity`).
- Look for `SecResponseBodyMimeType` in the ModSecurity or web server configuration to see whether response body inspection is set up.

## Fix

- Move ModSecurity to `3.0.17` or later (affected: `3.0.0` through `3.0.17`, exclusive of the fix).

## Timeline

- 2026-11-05T16:40:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-73856

## Documents

- [advisory] Vendor advisory: github.com https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-vmg8-j66p-vgvw
- [fix] Patch: github.com https://github.com/owasp-modsecurity/ModSecurity/commit/23ccd9202114f8313df3773f7992782fd9949c98
- [fix] Release notes: github.com https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17

## From the sources

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can therefore be treated as unconfigured, causing ModSecurity to skip RESPONSE_BODY inspection. An unauthenticated requester can then receive response content that a phase 4 rule would otherwise block, including sensitive error or debug data. This issue is fixed in version 3.0.17.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_