Vulnerability in Owasp-Modsecurity Modsecurity

CVE-2026-73856

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can therefore be treated as unconfigured, causing ModSecurity to skip RESPONSE_BODY inspection. An unauthenticated requester can then receive response content that a phase 4 rule would otherwise block, including sensitive error or debug data. This issue is fixed in version 3.0.17.

Published .

CVSS v3 metric

CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-73856?
CVE-2026-73856 is a high-severity vulnerability in Owasp-Modsecurity Modsecurity, classified under Improper Handling of Case Sensitivity. CVSS score: 8.6/10. Published 2026-11-05.
How severe is CVE-2026-73856?
High severity. CVSS v3 base score is 8.6 out of 10.