CVE-2026-73856High· 8.6▾ TwilightModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries cas…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can therefore be treated as unconfigured, causing ModSecurity to skip RESPONSE_BODY inspection. An unauthenticated requester can then receive response content that a phase 4 rule would otherwise block, including sensitive error or debug data. This issue is fixed in version 3.0.17.
ModSecurity >= 3.0.0, < 3.0.17Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-104269High· 8.6ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)
CVE-2026-61813Low· 3.7ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download
CVE-2026-103932Medium· 5.8ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match
CVE-2026-85287Medium· 6.5HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service
CVE-2026-123012High· 7.1In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810
CVE-2026-63121Medium· 6.3Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules