Is CVE-2026-73856 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73856 being exploited in the wild.

How severe is CVE-2026-73856?

High severity, with a CVSS score of 8.6, published 5 November 2026.

Which products and versions are affected?

OWASP Modsecurity 3.0.0 through 3.0.16.

Is there a fix for CVE-2026-73856?

Yes: fixed in 3.0.17. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73856 attacked?

It is attacked over the network.

Am I affected by CVE-2026-73856?

Check whether you run OWASP Modsecurity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73856: ModSecurity response body inspection bypass with mixed-case Content-Type

CVE-2026-73856 · Severity: high · CVSS 8.6 · Published 2026-11-05

ModSecurity is a web application firewall that inspects network traffic to block malicious requests and responses. In affected versions, the firewall fails to inspect response bodies when the server sends a Content-Type header in mixed case (e.g., "Text/HTML" instead of "text/html"), even though these are semantically identical. An attacker can exploit this to cause the firewall to miss sensitive error messages, debug data, or other blocked content that should be filtered.

Technologies: OWASP Modsecurity. Vendors: OWASP.

Quick answers

Is CVE-2026-73856 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73856 being exploited in the wild.
How severe is CVE-2026-73856?: High severity, with a CVSS score of 8.6, published 5 November 2026.
Which products and versions are affected?: OWASP Modsecurity 3.0.0 through 3.0.16.
Is there a fix for CVE-2026-73856?: Yes: fixed in 3.0.17. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73856 attacked?: It is attacked over the network.
Am I affected by CVE-2026-73856?: Check whether you run OWASP Modsecurity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.0.17

Technical details

ModSecurity's src/transaction.cc performs case-sensitive string comparison when checking if a response's Content-Type should trigger RESPONSE_BODY inspection against SecResponseBodyMimeType rules. An attacker can craft a response with a mixed-case Content-Type equivalent to a configured lowercase type, bypassing phase 4 inspection rules. The fix implements case-insensitive comparison using tolower() on the response Content-Type value before lookup.

Affected products

OWASP ModSecurity 3.0.0 through 3.0.16

Timeline

2026-11-05: disclosed
2026-09-29: patched: v3.0.17 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.