High severity · published Feb 25, 2025
CVE-2025-27110
Libmodsecurity3 has possible bypass of encoded HTML entities
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurity3 can't decode encoded HTML entities if they contains leading zeroes. Version 3.0.14 contains a fix. No known workarounds are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
ModSecurity · owasp-modsecurity
= 3.0.13 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27110
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27110
Exploit
https://github.com/owasp-modsecurity/ModSecurity/issues/3340
Vendor Advisory
https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-42w7-rmv5-4x2j
More from ModSecurity
8.6
CVE-2026-52747
ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass
8.6
CVE-2024-1019
WAF bypass of the ModSecurity v3 release line
7.5
CVE-2026-42268
ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators
7.5
CVE-2026-30923
libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings
7.5
CVE-2025-48866
ModSecurity has possible DoS vulnerability in sanitiseArg action