CVE-2026-73856: ModSecurity: Response Body Inspection Bypass
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can therefore be treated as unconfigured, causing ModSecurity to skip RESPONSEBODY inspection. An unauthenticated requester can then receive response content that a phase 4 rule would otherwise block, including sensitive error or debug data. This issue is fixed in version 3.0.17.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ModSecurityto a version that resolves this vulnerability.Fixed in 3.0.17
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
ModSecurity versions 3.0.0 through 3.0.17 are affected when response-body inspection is configured for a media type whose configured casing differs from the response Content-Type casing. The issue concerns phase 4 rules that inspect and potentially block response bodies.
What does an attacker need to exploit the issue?
An attacker does not need authentication, user interaction, or special privileges. They need to trigger an application response using a mixed-case Content-Type that is semantically equivalent to a configured response-body MIME type, causing ModSecurity to skip RESPONSE_BODY inspection.
What is the impact of successful exploitation?
Response content that a phase 4 rule would otherwise block can be returned to the requester. The advisory specifically identifies sensitive error or debug data as potentially exposed.
How should this be remediated?
Update ModSecurity to version 3.0.17, which fixes the case-sensitive Content-Type comparison.