{"id":"CVE-2025-27110","summary":"Libmodsecurity3 has possible bypass of encoded HTML entities","details":"Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurity3 can't decode encoded HTML entities if they contains leading zeroes. Version 3.0.14 contains a fix. No known workarounds are available.","aliases":["BIT-modsecurity-2025-27110","BIT-modsecurity2-2025-27110","GHSA-42w7-rmv5-4x2j"],"modified":"2026-08-12T03:51:39.674765583Z","published":"2025-02-25T20:00:44.211Z","related":["openSUSE-SU-2025:14946-1"],"database_specific":{"cwe_ids":["CWE-172"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27110.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27110.json"},{"type":"ADVISORY","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-42w7-rmv5-4x2j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27110"},{"type":"REPORT","url":"https://github.com/owasp-modsecurity/ModSecurity/issues/3340"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/owasp-modsecurity/modsecurity","events":[{"introduced":"580fe192df1694934f93e3e008058996ea479e35"},{"last_affected":"580fe192df1694934f93e3e008058996ea479e35"}],"database_specific":{"cpe":"cpe:2.3:a:trustwave:modsecurity:3.0.13:*:*:*:*:*:*:*","extracted_events":[{"introduced":"= 3.0.13"},{"last_affected":"= 3.0.13"},{"introduced":"3.0.13"},{"last_affected":"3.0.13"}],"source":["AFFECTED_FIELD","CPE_STRING"]}}],"versions":["3.0.13","= 3.0.13","v3.0.13"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27110.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H"}]}