CVE-2025-27110: Libmodsecurity3 has possible bypass of encoded HTML entities

Published Feb 25, 2025

Updated

Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurity3 can't decode encoded HTML entities if they contains leading zeroes. Version 3.0.14 contains a fix. No known workarounds are available.

Affected Software

2 affected components

ModSecurity Libmodsecurity3

Trustwave ModSecurity=3.0.13

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Libmodsecurity3 to a version that resolves this vulnerability.
Fixed in 3.0.14

Event History

Feb 25, 2025

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

DescriptionWeakness

Sep 15, 57206

Event

via FIRST·08:41 PM

Frequently Asked Questions

What is the severity of CVE-2025-27110?

CVE-2025-27110 is classified as a medium severity vulnerability.

How do I fix CVE-2025-27110?

To fix CVE-2025-27110, upgrade Libmodsecurity to version 3.0.14 or later.

What software is affected by CVE-2025-27110?

CVE-2025-27110 affects Libmodsecurity3 version 3.0.13.

What type of vulnerability is CVE-2025-27110?

CVE-2025-27110 is a bug in the Libmodsecurity component of ModSecurity that can impact web traffic processing.

When was CVE-2025-27110 reported?

CVE-2025-27110 was reported in 2025, associated with the release of Libmodsecurity3 version 3.0.13.