CVE-2025-27110 - CVE House
Back to Database
Status published High CVE-2025-27110

Libmodsecurity3 has possible bypass of encoded HTML entities

Vulnerability Description

Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurity3 can't decode encoded HTML entities if they contains leading zeroes. Version 3.0.14 contains a fix. No known workarounds are available.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-27110

Credits & Attribution

No credits recorded in the NVD database.

References

More from owasp-modsecurity

View All →
CVE-2025-54571
ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure
Medium 6.9
CVE-2025-52891
ModSecurity empty XML tag causes segmentation fault
Medium 6.5
CVE-2025-48866
ModSecurity has possible DoS vulnerability in sanitiseArg action
High 7.5
CVE-2025-47947
ModSecurity Has Possible DoS Vulnerability
High 7.5

Affected Vendor

owasp-modsecurity

View all reports →

Affected Software

ModSecurity
Vulnerable Versions:
= 3.0.13

Timeline

Official Publish: February 25th, 2025
Last Modified: February 26th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-172

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.