Read the docs
TI-2026-85489 Aliases CVE-2026-73856

ModSecurity Response Body Inspection Bypass via Mixed-Case Content-Type

Priority LOW 38CWE-178Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

ModSecurity, an open source web application firewall engine for Apache, IIS and Nginx, compares response Content-Type values against SecResponseBodyMimeType entries case-sensitively in src/transaction.cc in versions from 3.0.0 before 3.0.17. A mixed-case response media type equivalent to a configured lowercase type is treated as unconfigured, so ModSecurity skips RESPONSE_BODY inspection. An unauthenticated requester can then receive content that a phase 4 rule would have blocked, including sensitive error or debug data. The weakness is CWE-178, Improper Handling of Case Sensitivity, and the CNA scores it 8.6 (HIGH) under CVSS 3.1.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can therefore be treated as unconfigured, causing ModSecurity to skip RESPONSE_BODY inspection. An unauthenticated requester can then receive response content that a phase 4 rule would otherwise block, including sensitive error or debug data. This issue is fixed in version 3.0.17.

Why it matters now

EPSS 0.00565 47th percentileScored 2026-11-07
Fix Fixed ModSecurity (owasp-modsecurity): 3.0.17

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
owasp-modsecurityModSecurity3.0.0 to before 3.0.173.0.17Patch availableCNA
  • ModSecurity Vendorowasp-modsecurity Affected 3.0.0 to before 3.0.17 Fixed in 3.0.17 Patch available CNA

Remediation

Upgrade ModSecurity to version 3.0.17, which fixes the issue. CISA has not added this vulnerability to KEV, and the references contain no exploit link.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA ModSecurity (owasp-modsecurity) Fixed in 3.0.17

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-73856
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat
  4. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2026-37865 ModSecurity: Multipart form-data parser silently strips embedded line breaks from… CVSS 3.1HIGH 8.6
  • TI-2025-40548 FACTION Unauthenticated Custom Extension Upload leads to RCE CVSS 3.1CRITICAL 9.8
  • TI-2022-07517 Path Traversal in ESAPI CVSS 3.1CRITICAL 9.8
  • TI-2026-30581 ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators CVSS 4.0HIGH 8.2
  • TI-2026-23748 libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings CVSS 4.0HIGH 8.2
  • TI-2025-19980 Libmodsecurity3 has possible bypass of encoded HTML entities CVSS 4.0HIGH 7.9
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences