DEBIAN-CVE-2026-73856

    Dashboard / Vulnerabilities / DEBIAN-CVE-2026-73856

    DEBIAN-CVE-2026-73856

    Published: 5 Nov 2026Last Modified: 6 Nov 2026
    Upstream:
    CVE-2026-73856

    Summary:

    Details: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can therefore be treated as unconfigured, causing ModSecurity to skip RESPONSE_BODY inspection. An unauthenticated requester can then receive response content that a phase 4 rule would otherwise block, including sensitive error or debug data. This issue is fixed in version 3.0.17.

    References: https://security-tracker.debian.org/tracker/CVE-2026-73856

    Affected packages

    Package

    Name: modsecurity

    Purl: pkg:deb/debian/modsecurity?arch=source&distro=bookworm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    3.0.10-1
    3.0.11-1
    3.0.12-1
    3.0.12-1.1
    3.0.12-1.1~exp1
    3.0.13-1
    3.0.14-1
    3.0.15-1
    3.0.16-1
    3.0.9-1
    3.0.9-1+deb12u1
    3.0.9-1+deb12u2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DEBIAN-CVE-2026-73856 | CVE-DB