Improper Handling of Case Sensitivity in ModSecurity - CVE-2026-73856
Published: November 4, 2026
Vulnerability identifier: #VU159009
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73856
CWE-ID: CWE-178
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass response body inspection and obtain sensitive information that would otherwise be blocked.
The vulnerability exists due to improper handling of case sensitivity in ModSecurity's SecResponseBodyMimeType matching logic in src/transaction.cc when checking backend response Content-Type values. A remote attacker can trigger a backend response with Content-Type: Text/Html instead of text/html to cause RESPONSE_BODY rules to be skipped and retrieve sensitive response content.
Affected software
ModSecurity
How to mitigate CVE-2026-73856
Install security update from vendor's website.
ModSecurity - update to 3.0.17