CVE-2026-73856

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73856", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-13T17:44:28.645Z", "datePublished": "2026-11-05T15:50:09.778Z", "dateUpdated": "2026-11-09T22:12:13.373Z"}, "containers": {"cna": {"title": "ModSecurity: Response Body Inspection Bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-178", "lang": "en", "description": "CWE-178: Improper Handling of Case Sensitivity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-vmg8-j66p-vgvw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-vmg8-j66p-vgvw"}, {"name": "https://github.com/owasp-modsecurity/ModSecurity/commit/23ccd9202114f8313df3773f7992782fd9949c98", "tags": ["x_refsource_MISC"], "url": "https://github.com/owasp-modsecurity/ModSecurity/commit/23ccd9202114f8313df3773f7992782fd9949c98"}, {"name": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17", "tags": ["x_refsource_MISC"], "url": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"}], "affected": [{"vendor": "owasp-modsecurity", "product": "ModSecurity", "versions": [{"version": ">= 3.0.0, < 3.0.17", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T15:50:09.778Z"}, "descriptions": [{"lang": "en", "value": "ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can therefore be treated as unconfigured, causing ModSecurity to skip RESPONSE_BODY inspection. An unauthenticated requester can then receive response content that a phase 4 rule would otherwise block, including sensitive error or debug data. This issue is fixed in version 3.0.17."}], "source": {"advisory": "GHSA-vmg8-j66p-vgvw", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-vmg8-j66p-vgvw", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T22:11:44.794859Z", "id": "CVE-2026-73856", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T22:12:13.373Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73856", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-13T17:44:28.645Z", "datePublished": "2026-11-05T15:50:09.778Z", "dateUpdated": "2026-11-09T22:12:13.373Z"}, "containers": {"cna": {"title": "ModSecurity: Response Body Inspection Bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-178", "lang": "en", "description": "CWE-178: Improper Handling of Case Sensitivity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-vmg8-j66p-vgvw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-vmg8-j66p-vgvw"}, {"name": "https://github.com/owasp-modsecurity/ModSecurity/commit/23ccd9202114f8313df3773f7992782fd9949c98", "tags": ["x_refsource_MISC"], "url": "https://github.com/owasp-modsecurity/ModSecurity/commit/23ccd9202114f8313df3773f7992782fd9949c98"}, {"name": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17", "tags": ["x_refsource_MISC"], "url": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"}], "affected": [{"vendor": "owasp-modsecurity", "product": "ModSecurity", "versions": [{"version": ">= 3.0.0, < 3.0.17", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T15:50:09.778Z"}, "descriptions": [{"lang": "en", "value": "ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can therefore be treated as unconfigured, causing ModSecurity to skip RESPONSE_BODY inspection. An unauthenticated requester can then receive response content that a phase 4 rule would otherwise block, including sensitive error or debug data. This issue is fixed in version 3.0.17."}], "source": {"advisory": "GHSA-vmg8-j66p-vgvw", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73856", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T22:11:44.794859Z"}}}], "references": [{"url": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-vmg8-j66p-vgvw", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T22:12:04.163Z"}}]}}

{"affected": [{"affectedData": [{"product": "ModSecurity", "vendor": "owasp-modsecurity", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.0.17"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can therefore be treated as unconfigured, causing ModSecurity to skip RESPONSE_BODY inspection. An unauthenticated requester can then receive response content that a phase 4 rule would otherwise block, including sensitive error or debug data. This issue is fixed in version 3.0.17."}], "id": "CVE-2026-73856", "lastModified": "2026-11-12T22:18:51.470", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73856", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T22:11:44.794859Z", "version": "2.0.3"}}]}, "published": "2026-11-05T16:17:48.443", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/owasp-modsecurity/ModSecurity/commit/23ccd9202114f8313df3773f7992782fd9949c98"}, {"source": "security-advisories@github.com", "url": "https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"}, {"source": "security-advisories@github.com", "url": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-vmg8-j66p-vgvw"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-vmg8-j66p-vgvw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-178"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "modsecurity: modsecurity: Information disclosure via case-sensitive Content-Type matching", "id": "2567811", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567811"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-178", "details": ["A flaw was found in ModSecurity, which can lead to information disclosure. The web application firewall evaluates HTTP response Content-Type headers case-sensitively against configured rules, causing mixed-case media types to bypass response body inspection. An unauthenticated remote attacker can exploit this issue to receive restricted server responses that would otherwise be blocked, potentially exposing sensitive error or debug data."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-73856", "public_date": "2026-11-05T15:50:09Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-73856\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-73856\nhttps://github.com/owasp-modsecurity/ModSecurity/commit/23ccd9202114f8313df3773f7992782fd9949c98\nhttps://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17\nhttps://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-vmg8-j66p-vgvw"], "statement": "Red Hat rates this vulnerability as Important because an unauthenticated remote attacker can completely circumvent outbound web application firewall filtering without requiring privileges or user interaction. This elevated severity reflects the ability to bypass defensive inspection boundaries over the network, allowing confidential server data to leak to unauthorized clients. Deployments utilizing ModSecurity to intercept outbound response payloads are directly exposed whenever backend web services emit mixed-case MIME headers. Environments where response body analysis is not utilized or where backend servers consistently emit strictly lowercase media headers face lower operational exposure.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.0.17)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ModSecurity", "source": "cna", "vendor": "owasp-modsecurity"}, "product": "modsecurity", "vendor": "modsecurity"}], "created": "2026-11-05T17:45:06.312921+00:00", "updated": "2026-11-05T19:00:18.406195+00:00", "vendors": ["modsecurity", "modsecurity$PRODUCT$modsecurity"]}