Ubuntu (unspecified component) CVE-2026-73856

Exploitation requires that the vulnerable component inspect HTTP response bodies and select or gate that inspection on the Content-Type header, AND that the attacker can influence the Content-Type value of a response (typically by controlling or compromising the upstream/origin server whose responses flow through the inspecting component). The specific trigger is a Content-Type using non-canonical character casing that the inspection logic fails to match against its canonical (lowercased) comparison. Limiting factors: the attacker must be positioned to set the response Content-Type, a response-inspection feature must be enabled and relied upon, and the practical impact is bounded by what that inspection protects. NOTE: because the product and its CVSS vector are absent from the input, authentication requirements are not confirmed from available data and the exact configuration preconditions cannot be tied to a named feature.

This is a security-control bypass (GHSA-vmg8-j66p-vgvw) in which response-body inspection can be evaded by supplying a Content-Type header with non-canonical casing (e.g. 'Application/JSON' or 'Text/HTML' instead of the lowercased canonical form), implying the inspecting component matches Content-Type case-sensitively - consistent with CWE-178 (Improper Handling of Case Sensitivity) and CWE-693 (Protection Mechanism Failure). Risk signals are almost entirely absent: no CVSS score or vector, no CWE, no EPSS probability, no KEV listing, and no POC flag were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The real-world severity is entirely contingent on what the bypassed inspection protects - if it is a WAF, DLP, antivirus, or content-filtering layer, the bypass lets disallowed response content reach a protected consumer, but the flaw itself does not grant code execution or data disclosure. Critically, the affected PRODUCT is NOT named in the input (only the GHSA ID, advisory title, and 'vendor:ubuntu' as source), so prevalence and blast radius cannot be reliably determined. This should be treated as a moderate control-integrity issue pending product identification - not a confirmed high-priority emergency, since no CVSS, EPSS, KEV, or POC signal elevates it.

An attacker who controls an upstream HTTP response (e.g. a malicious or compromised origin server reached through the affected inspecting proxy/filter) sets the Content-Type header using non-canonical casing so the body is not recognized for inspection. The inspection engine skips or misclassifies the response, allowing content that policy should block or sanitize to pass through to the protected client. No public POC is referenced in the provided data.