libModSecurity3: REQUEST_HEADERS names are treated as case sensitive with configure-time rule-exclusions

Author: EsadCetinerCreated Aug 7, 2026Updated Aug 23, 2026

Labels3.x:1st_place_medal: good first issue

Describe the bug

This bug is similar to: https://github.com/owasp-modsecurity/ModSecurity/issues/3441, which also doesn't appear in ModSecurity2.

Logs and dumps

N/A

To Reproduce

Re-using the previous example in this issue, say I have this rule:

bash

SecRule REQUEST_HEADERS:Referer "@contains <evil-string>" \
    "id:2,\
    phase:1,\
    deny,\
    t:none,\
    log"

and I want to write a rule-exclusion for this rule via a configure-time rule-exclusion:

SecRuleUpdateTargetById 2 !REQUEST_HEADERS:referer

This rule-exclusion works if the client sends a lowercase referer header:

$ curl -H "referer: <evil-string>" localhost:8080

But if the client sends an uppercase referer header, then the request is wrongly blocked:

$ curl -H "Referer: <evil-string>" localhost:8080
<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.28.3 (Ubuntu)</center>
</body>
</html>

If I exclude both uppercase and lowercase referer header, then the rule-exclusion works as expected.

SecRuleUpdateTargetById 2 !REQUEST_HEADERS:Referer
SecRuleUpdateTargetById 2 !REQUEST_HEADERS:referer

Expected behavior

Request header case should be ignored.

Server (please complete the following information):

OS: Ubuntu 26.04
ModSecurity Version: 3.0.17
NGINX Connector Version: v1.0.4
NGINX Version: 1.28.3

Rule Set (please complete the following information):

N/A

Additional context

Source: owasp-modsecurity/ModSecurity

View original on GitHub View discussion on GitHub