CVE-2026-73856
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS…
- Risk score
- 67/100
- CVSS
- 8.6 v3.1
- Published
- 5 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- ModSecurity has a flaw in versions 3.0.0 to 3.0.17 where it incorrectly handles mixed-case response media types, allowing an attacker to receive sensitive data that would otherwise be blocked. An attacker can exploit this vulnerability without authentication.
- Affected
- {'products': ['ModSecurity'], 'packages': [], 'versions': ['3.0.0', '3.0.1', '3.0.2', '3.0.3', '3.0.4', '3.0.5', '3.0.6', '3.0.7', '3.0.8', '3.0.9', '3.0.10', '3.0.11', '3.0.12', '3.0.13', '3.0.14', '3.0.15', '3.0.16', '3.0.17']}
- Fix
- Upgrade to version 3.0.17 or later
- Exploitation
- No known exploitation
Not confirmed. 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8 isn't in the advisory. Check the vendor's advisory before acting on this.
Why it is Amber
- CVSS 8.6 high
- Remotely exploitable without logging in
- On your watchlist: nginx
References
Original description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can therefore be treated as unconfigured, causing ModSecurity to skip RESPONSE_BODY inspection. An unauthenticated requester can then receive response content that a phase 4 rule would otherwise block, including sensitive error or debug data. This issue is fixed in version 3.0.17.
Last activity 5 Nov 2026. Patch Forecast updates every hour.