Response Body Inspection Issue in ModSecurity WAF Engine for Apache, IIS, and Nginx

CVE-2026-73856

What is CVE-2026-73856?

The ModSecurity web application firewall engine versions 3.0.0 through 3.0.17 suffers from a vulnerability that arises from case-sensitive comparisons of response Content-Type values against SecResponseBodyMimeType entries. This flaw can lead to a situation where a mixed-case response media type, which is semantically equivalent to a configured lowercase type, may be improperly treated as an unconfigured type. As a result, ModSecurity can overlook RESPONSE_BODY inspections. An unauthenticated attacker could potentially access response content that would typically be blocked by phase 4 rules, including sensitive error messages or debugging information. The issue is resolved in version 3.0.17.

References