# CVE-2026-73856: ModSecurity response body inspection bypass with mixed-case Content-Type

Source: https://junglewise.ai/threats/cve-2026-73856-modsecurity-is-an-open-source-cross-platform-web-application  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-73856 · Severity: high · CVSS 8.6 · Published 2026-11-05

ModSecurity is a web application firewall that inspects network traffic to block malicious requests and responses. In affected versions, the firewall fails to inspect response bodies when the server sends a Content-Type header in mixed case (e.g., "Text/HTML" instead of "text/html"), even though these are semantically identical. An attacker can exploit this to cause the firewall to miss sensitive error messages, debug data, or other blocked content that should be filtered.

Technologies: [OWASP Modsecurity](https://junglewise.ai/threats/technologies/modsecurity). Vendors: [OWASP](https://junglewise.ai/threats/vendors/owasp).

## Quick answers

**Is CVE-2026-73856 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73856 being exploited in the wild.

**How severe is CVE-2026-73856?** High severity, with a CVSS score of 8.6, published 5 November 2026.

**Which products and versions are affected?** OWASP Modsecurity 3.0.0 through 3.0.16.

**Is there a fix for CVE-2026-73856?** Yes: fixed in 3.0.17. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73856 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73856?** Check whether you run OWASP Modsecurity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.0.17

## Technical details

ModSecurity's src/transaction.cc performs case-sensitive string comparison when checking if a response's Content-Type should trigger RESPONSE_BODY inspection against SecResponseBodyMimeType rules. An attacker can craft a response with a mixed-case Content-Type equivalent to a configured lowercase type, bypassing phase 4 inspection rules. The fix implements case-insensitive comparison using tolower() on the response Content-Type value before lookup.

## Affected products

- OWASP ModSecurity 3.0.0 through 3.0.16

## Timeline

- 2026-11-05: disclosed
- 2026-09-29: patched: v3.0.17 released

## References

- [https://github.com/owasp-modsecurity/ModSecurity/commit/23ccd9202114f8313df3773f7992782fd9949c98](https://github.com/owasp-modsecurity/ModSecurity/commit/23ccd9202114f8313df3773f7992782fd9949c98)
- [https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17](https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17)

## Related threats

- [ModSecurity uninitialized pointer dereference in XML parsing](https://junglewise.ai/threats/cve-2026-73857-modsecurity-is-an-open-source-cross-platform-web-application)
- [ModSecurity htmlEntityDecode rule bypass via incomplete entity handling](https://junglewise.ai/threats/cve-2026-61812-modsecurity-is-an-open-source-cross-platform-web-application)
- [ModSecurity removeComments bypass via adjacent comments](https://junglewise.ai/threats/cve-2026-104259-modsecurity-is-an-open-source-cross-platform-web-application)
- [ModSecurity multipart parser filename precedence bypass](https://junglewise.ai/threats/cve-2026-104269-modsecurity-is-an-open-source-cross-platform-web-application)
- [ModSecurity @rxGlobal match-limit bypass](https://junglewise.ai/threats/cve-2026-103932-modsecurity-is-an-open-source-cross-platform-web-application)