ModSecurity, a widely used web application firewall, fails to interrogate response bodies correctly when the Content-Type header contains a mixed‑case MIME type that is semantically equivalent to a lower‑case value defined in SecResponseBodyMimeType. The faulty case‑sensitive string comparison causes ModSecurity to skip the RESPONSE_BODY inspection phase, allowing an unauthenticated requester to receive content that phase‑4 rules would otherwise block. This flaw can expose sensitive error or debug information, compromising confidentiality. The weakness is an improper equality comparison (CWE‑178).

All ModSecurity releases from 3.0.0 up to and including 3.0.17 are affected. The flaw applies to the engine when deployed behind Apache, IIS, or Nginx web servers, as the transaction.cc component executing the comparison is common to all platforms.

With a CVSS score of 8.6, the vulnerability is considered high severity. The EPSS score is not currently available, so the measured probability of exploitation is unknown, but the issue is not listed in the CISA KEV catalog, suggesting no confirmed public exploits yet. An attacker only needs to issue an unauthenticated HTTP request that elicits a response containing a mixed‑case Content-Type header matching a configured lower‑case MIME type. Successful exploitation would bypass ModSecurity’s response body inspection and disclose sensitive data that would normally be blocked.