CVE-2026-73856: falha de alta gravidade em owasp-modsecurity ModSecurity
ModSecurity: Response Body Inspection Bypass
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6epss 0.6%
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can therefore be treated as unconfigured, causing ModSecurity to skip RESPONSE_BODY inspection. An unauthenticated requester can then receive response content that a phase 4 rule would otherwise block, including sensitive error or debug data. This issue is fixed in version 3.0.17.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
owasp-modsecurity · ModSecurityCVEs relacionadas — owasp-modsecurity ModSecurity
No mesmo produto, das mais perigosas para as menos.
CVE-2025-48866HIGHModSecurity has possible DoS vulnerability in sanitiseArg actionEPSS 0.9%CVE-2025-47947HIGHModSecurity Has Possible DoS VulnerabilityEPSS 0.6%CVE-2026-104269HIGHModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)EPSS 0.6%CVE-2025-27110HIGHLibmodsecurity3 has possible bypass of encoded HTML entitiesEPSS 0.5%CVE-2026-52747HIGHModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypassEPSS 0.5%CVE-2026-30923HIGHlibModSecurity3 denial of service via segfault when using t:hexDecode on single-character query stringsEPSS 0.4%